Multi Admin Approval
Action required — If this warning appears in the Assignments Manager, assignment changes will fail until the IntuneAssistant backend API enterprise app is excluded from the active MAA policy.
What is Multi-Admin Approval?
Multi-Admin Approval (MAA) is a security feature in Microsoft Intune that enforces a four-eyes principle for policy changes. When MAA is active, any attempt to create, update, or delete a protected resource requires a second administrator to review and approve the change before it takes effect.
Microsoft extended MAA beyond the Intune portal — it also applies to application-authenticated Microsoft Graph API calls. This means any backend service that modifies Intune policies on your behalf is subject to the same approval requirement.
MAA applies per policy type. You may have it active for configuration policies but not compliance policies, or vice versa.
The Warning Banner
When you open the Assignments Manager, IntuneAssistant automatically checks whether MAA is active for any of the following policy types:
Configuration Policies (
configurationPolicy)Compliance Policies (
compliancePolicy)Scripts (
scripts)
If MAA is active for one of these types and the IntuneAssistant backend API enterprise application is not listed as an exclusion, an amber warning banner appears at the top of the Assignments Manager page.
Do not apply changes while this warning is visible. Any assignment change you attempt will be blocked by MAA and will fail. The change will not be queued for approval — it will simply be rejected.
The x-msft-approval-justification Error
x-msft-approval-justification ErrorIf you attempt to apply changes while MAA is active without an exclusion, the Microsoft Graph API rejects the request with:
This is not a permissions error. It means MAA intercepted the API call. The change is not queued for approval — it is rejected outright. You must fix the exclusion first.
Unlike a human administrator making a change in the Intune portal — where MAA creates a pending approval request — an automation tool that does not explicitly send the x-msft-approval-justification header receives an error and the operation stops entirely. IntuneAssistant is designed to be excluded, not to participate in the approval workflow.
How to Fix It — Exclude IntuneAssistant from MAA
Open the MAA policy in Intune
Go to the Intune admin center
Navigate to Tenant administration → Multi Admin Approval
Open the policy that covers
configurationPolicy,compliancePolicy, orscripts
Add the app exclusion
Inside the policy, locate the App Exclusions section
Click Add and search for IntuneAssistant (the enterprise application registered in your tenant during onboarding)
Select it and save the policy
The IntuneAssistant enterprise app ID is afe66ddf-67d4-4d61-8a51-beca7b799f52. If the search does not find it by name, use this ID.
What Happens in Each Scenario
MAA active, IntuneAssistant not excluded
Every write operation fails — x-msft-approval-justification error
MAA active, IntuneAssistant excluded
Assignments Manager works normally
No MAA policy active for the relevant policy types
No warning shown, no impact
Security Considerations
Excluding IntuneAssistant from MAA does not bypass human approval for human administrators. The exclusion applies only to the IntuneAssistant service principal (app identity), not to individual user accounts.
Changes made by IntuneAssistant still appear in the Intune audit log
Human administrators remain subject to MAA approval requirements
You can set an exclusion expiry date on the MAA policy if you want the exclusion to be time-limited
Excluding a trusted automation identity from MAA is standard practice and recommended by Microsoft. It maintains security for human-initiated changes while keeping automation operational.