> For the complete documentation index, see [llms.txt](https://docs.intuneassistant.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.intuneassistant.cloud/extensions/assignments-manager/multi-admin-approval.md).

# Multi Admin Approval

{% hint style="warning" %}
**Action required** — If this warning appears in the Assignments Manager, assignment changes will fail until the IntuneAssistant backend API enterprise app is excluded from the active MAA policy.
{% endhint %}

## What is Multi-Admin Approval?

Multi-Admin Approval (MAA) is a security feature in Microsoft Intune that enforces a **four-eyes principle** for policy changes. When MAA is active, any attempt to create, update, or delete a protected resource requires a second administrator to review and approve the change before it takes effect.

Microsoft extended MAA beyond the Intune portal — it also applies to **application-authenticated Microsoft Graph API calls**. This means any backend service that modifies Intune policies on your behalf is subject to the same approval requirement.

{% hint style="info" %}
MAA applies per policy type. You may have it active for configuration policies but not compliance policies, or vice versa.
{% endhint %}

***

## The Warning Banner

When you open the Assignments Manager, IntuneAssistant automatically checks whether MAA is active for any of the following policy types:

* **Configuration Policies** (`configurationPolicy`)
* **Compliance Policies** (`compliancePolicy`)
* **Scripts** (`scripts`)

If MAA is active for one of these types **and** the IntuneAssistant backend API enterprise application is not listed as an exclusion, an amber warning banner appears at the top of the Assignments Manager page.

{% hint style="danger" %}
**Do not apply changes while this warning is visible.** Any assignment change you attempt will be blocked by MAA and will fail. The change will **not** be queued for approval — it will simply be rejected.
{% endhint %}

***

## The `x-msft-approval-justification` Error

If you attempt to apply changes while MAA is active without an exclusion, the Microsoft Graph API rejects the request with:

```
Header 'x-msft-approval-justification' is required to request approval.
```

{% hint style="warning" %}
This is **not** a permissions error. It means MAA intercepted the API call. The change is not queued for approval — it is rejected outright. You must fix the exclusion first.
{% endhint %}

Unlike a human administrator making a change in the Intune portal — where MAA creates a pending approval request — an automation tool that does not explicitly send the `x-msft-approval-justification` header receives an error and the operation stops entirely. IntuneAssistant is designed to be excluded, not to participate in the approval workflow.

***

## How to Fix It — Exclude IntuneAssistant from MAA

{% stepper %}
{% step %}

### Open the MAA policy in Intune

1. Go to the [Intune admin center](https://intune.microsoft.com/)
2. Navigate to **Tenant administration** → **Multi Admin Approval**
3. Open the policy that covers `configurationPolicy`, `compliancePolicy`, or `scripts`
   {% endstep %}

{% step %}

### Add the app exclusion

1. Inside the policy, locate the **App Exclusions** section
2. Click **Add** and search for **IntuneAssistant** (the enterprise application registered in your tenant during onboarding)
3. Select it and save the policy

{% hint style="info" %}
The IntuneAssistant enterprise app ID is `afe66ddf-67d4-4d61-8a51-beca7b799f52`. If the search does not find it by name, use this ID.
{% endhint %}
{% endstep %}

{% step %}

### Verify the fix

Reload the Assignments Manager page. The amber warning banner will disappear once IntuneAssistant detects the app is in the exclusion list.
{% endstep %}
{% endstepper %}

***

## What Happens in Each Scenario

| Scenario                                           | Result                                                              |
| -------------------------------------------------- | ------------------------------------------------------------------- |
| MAA active, IntuneAssistant **not** excluded       | Every write operation fails — `x-msft-approval-justification` error |
| MAA active, IntuneAssistant **excluded**           | Assignments Manager works normally                                  |
| No MAA policy active for the relevant policy types | No warning shown, no impact                                         |

***

## Security Considerations

Excluding IntuneAssistant from MAA does **not** bypass human approval for human administrators. The exclusion applies only to the IntuneAssistant service principal (app identity), not to individual user accounts.

* Changes made by IntuneAssistant still appear in the Intune audit log
* Human administrators remain subject to MAA approval requirements
* You can set an **exclusion expiry date** on the MAA policy if you want the exclusion to be time-limited

{% hint style="success" %}
Excluding a trusted automation identity from MAA is standard practice and recommended by Microsoft. It maintains security for human-initiated changes while keeping automation operational.
{% endhint %}

***

## Further Reading

* [PatchMyPC — Intune Multi Admin Approval: the x-msft-approval-justification error](https://patchmypc.com/blog/intune-multi-admin-approval-the-x-msft-approval-justification-error)
* [Microsoft Docs — Use multi admin approval in Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/multi-admin-approval)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.intuneassistant.cloud/extensions/assignments-manager/multi-admin-approval.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.