When any Intune admin attempts to create or change a script/app that is protected by an MAA access policy, Intune will queue the request after the user enters a business justification as shown here: Select the group containing the members who can approve requests for create, edit, assign, and delete scripts. You will need to create two separate access policies, one for Apps and one for Scripts. To create an access policy, your account must be assigned the Intune Service Administrator or Azure Global Administrator role. You can navigate to this important control here: That is like what should happen when an admin account is taken over, goes rogue and tries to distribute ransomware in your environment – someone should be shouting MAA!!! Lol!

A memory trick to always remember this is imagine your sibling shouting “MAAAAA!” when you are doing something wrong. Intune has a new feature called Multi Admin Approval (MAA) which is extremely important to enable because it reduces the risk that an attacker who compromises an Intune Admin can use that privilege to distribute ransomware to all endpoints.

Intune mfa