MT.1096: Ensure at least one Intune Multi Admin Approval policy is configured

ID	MT.1096
Severity	Medium
Suite	Mito
Product	Intune
Feature	Tenant administration
Security area	Privileged access
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Framework controls	nist-800-53-r5:AC-3(2) Access Enforcement | Dual Authorization nist-800-53-r5:CM-5(4) Access Restrictions for Change | Dual Authorization
MITRE ATT&CK	T1072, T1078.004
Reads from	Microsoft Graph
Licence needed	INTUNE_A

What this checks and how to fix it

Ensure at least one Intune Multi Admin Approval Policy is configured. Microsoft Intune Multi Admin Approval helps to limit the impact of compromised administrators by requiring approval for sensitive activities.

Remediation action:

To create a multi admin approval policy:

1. Navigate to Microsoft Intune admin center.
2. Click Tenant Administration and select Multi Admin Approval or use the Microsoft Intune Portal - Multi Admin Approval direct link.
3. Select Access policies and create a new access policy, e.g. for Scripts
4. Let another Intune Administrator approve your request to create the access policy
5. Re-visit the access policies section and complete the policy creation.

Additional information:

• Use Access policies to require Multi Admin Approval

---

Mito check. Author: nicolonsky. Open-source licences.