Prepare the Intune approver group before protecting role changes

Source facts

Intune Multi Admin Approval requires an approver non-mail-enabled security group directly assigned as a member group in an Intune RBAC role assignment; permissions held separately by individual members are insufficient. Approvers need direct group membership and the relevant resource-read permission. Microsoft warns that enabling protection for role changes before preparing these assignments can create a configuration deadlock. Microsoft Learn.

Applicability

Apply this review when introducing the Role access-policy type. Inventory the requestor, approvers, existing role assignments, and any other protected resource types before enabling that protection.

DSE recommendation

Complete and review the approval-group assignment first. Have a different administrator verify the exact group identifier, membership, and required read capability rather than relying on a familiar group name. Schedule role protection only after the team has proven its other approval paths. Document an authorized recovery escalation in advance without treating removal of protection as a routine workaround.

Verification

Rehearse a permitted request with separate requestor and approver accounts. Microsoft requires the original requestor to select Complete after approval, so check the applied change rather than stopping at an approved status. Also verify that an unqualified account cannot approve and that the requestor cannot approve their own request. Keep the tested identities, resource scope, and outcome with the activation decision; do not infer readiness from group creation alone.

Official references

Microsoft Learn: Use Multi Admin Approval in Intune.