Anyone who has cleaned up after a compromised Intune admin account knows how much damage one overprivileged administrator can cause in a few minutes. In many of the tenants I review, only a handful of people hold the Intune Administrator role. Sometimes it's just one or two people with global power, and often there's no meaningful split by region or responsibility. That is a real risk, and attackers keep getting better at going after admin credentials. Strong passwords and MFA alone don't cover it anymore.

Intune multi admin approval stops one person from acting alone

With Intune multi admin approval, a single person can no longer push through sensitive actions on their own. That includes deleting or wiping devices, deploying scripts and changing admin roles. You configure the feature in the Intune admin center under Tenant administration → Multi Admin Approval. I see this as a big step forward. A second admin now has to explicitly approve any high-risk operation, and the whole thing ends up in the audit logs so you can review it later. Larger organizations get the most out of it, but small teams also gain from having one more barrier between a risky action and a disaster.

I've seen incidents where someone pushed a script to the wrong group by accident, or wiped a whole fleet of devices with one click. Multi admin approval would have caught both. This control holds up in day-to-day operations, not only in a policy document.

RBAC and scope tags form the security foundation

Multi admin approval gets really effective once you pair it with Intune RBAC (https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control) and scope tags (https://learn.microsoft.com/en-us/mem/intune/fundamentals/scope-tags). Intune's role-based access control lets you assign built-in or custom roles, such as Intune Administrator, Helpdesk Operator or Policy and Profile Manager, and adjust exactly what each role is allowed to do. My standing advice is to build custom roles that carry just enough rights for the job.

Scope tags go a step further. They limit what each admin can see and act on, based on region or team. With well-planned scopes and roles, a local IT admin in Berlin won't even see the devices managed by the Paris team, never mind change them. That helps with operational clarity as much as with security. If you skip this, the group of people who can approve sensitive actions is larger than it needs to be and harder to keep an eye on.

Practical tip: Start with a small, clear set of roles and scope tags. An overly complex RBAC design makes everything harder to manage and doesn't make you any more secure.

The approval workflow only pauses actions that match a policy

The flowchart below shows how the approval chain runs in Intune. It starts when an admin kicks off a high-risk action, ends when the action is executed, and marks the point where the second approval comes in:

flowchart TD
    A["Admin starts risky action"] --> B["Multi admin approval rule applies?"]
    B -- "No" --> E["Action is executed immediately"]
    B -- "Yes" --> C["Second admin approval required"]
    C --> D["Approval process in Intune admin center"]
    D --> F["Action is executed"]

Figure: The approval process with Intune multi admin approval

As the flow shows, only actions that match a configured policy are held for approval. Everything else runs as usual. So you have to choose deliberately which actions to protect, and the biggest risks should come first.

A small starting set covers approvals, roles and logs

In most tenants, I recommend turning on multi admin approval policies for the actions with the largest blast radius:

  • Script deployment and deletion
  • Device wipe, retire, and delete
  • Admin role or assignment changes
  • Assigning apps to large device groups

You set this up in the Intune admin center → Tenant administration → Multi Admin Approval. Use the opportunity to go through your RBAC setup and remove privileges nobody needs, particularly if you're still running on the out-of-the-box roles or have too many Global Admins. Scope tags should narrow responsibilities down to the smallest unit that still makes sense.

One more thing: Intune logs all relevant actions in its audit log (Intune admin center → Monitoring → Audit log). Put a regular review on the calendar, or automate exports for archiving. For changes that are truly sensitive, I suggest connecting Microsoft Sentinel or Log Analytics for alerting. That takes some setup work and the right licensing, though.

If you want to go deeper into emergency access (break glass) accounts and how to set them up, have a look at my earlier post: Getting emergency access accounts in Entra ID right.

Good security doesn't have to stifle your team

Intune multi admin approval should have arrived a long time ago. It finally puts real limits on what one admin can do, whether that admin is an attacker with stolen credentials or a colleague who makes a mistake. The important part is not to let security turn into bureaucracy. Pile on too many approval steps and your admins get frustrated and start looking for risky workarounds. A sensible mix works better. Protect the highest-risk actions, give RBAC roles a clear definition and use scope tags to keep the blast radius small. Revisit your policies regularly. You won't reach perfection, but you will make life a lot harder for attackers and for accidents.