Skip to content

Commit f6b511a

Browse files
authored
Merge pull request #8135 from Brenduns/9348867-mma-preview
2210 oob (slip from 2208) - 9348867 - Preview for multi-admin approvals
2 parents 5242a11 + a95c0a6 commit f6b511a

4 files changed

Lines changed: 148 additions & 6 deletions

File tree

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
---
2+
# required metadata
3+
4+
title: About multiple administrative approvals in Intune
5+
titleSuffix: Microsoft Intune
6+
description: Configure multi-admin approval to protect against compromised administrative accounts in Intune
7+
keywords:
8+
author: brenduns
9+
ms.author: brenduns
10+
manager: dougeby
11+
ms.date: 08/17/2022
12+
ms.topic: conceptual
13+
ms.service: microsoft-intune
14+
ms.subservice: fundamentals
15+
ms.localizationpriority: high
16+
17+
# optional metadata
18+
19+
#ROBOTS:
20+
#audience:
21+
ms.reviewer: craigma
22+
ms.suite: ems
23+
#ms.tgt_pltfrm:
24+
ms.custom: intune-azure
25+
ms.collection:
26+
- M365-identity-device-management
27+
- highpri
28+
---
29+
30+
# Use Access policies to require multiple administrative approvals
31+
32+
*This feature is in Public Preview*
33+
34+
To help protect against a compromised administrative account, use Intune *access policies* to require that a second administrative account is used to approve a change before the change is applied. This capability is known as multiple administrative approval (MAA).
35+
36+
With MAA, you configure access policies that protect specific configurations, like Apps or Scripts for devices. Access policies specify what is protected and which group of accounts are permitted to approve changes to those resources.
37+
38+
When any account in the Tenant is used to make a change to a resource that’s protected by an access policy, Intune won't apply the change until a different account explicitly approves it. Only administrators who are members of an approval group that’s assigned a protected resource in an access protection policy can approve changes. Approvers can also reject change requests.
39+
40+
Access policies are supported for the following resources:
41+
42+
- Apps – Applies to [app deployments](../apps/apps-add.md), but doesn't apply to app protection policies.
43+
- Scripts – Applies to deploying scripts to devices that run [macOS](../apps/macos-shell-scripts.md) or [Windows](../apps/intune-management-extension.md).
44+
45+
## Prerequisites for access policies and approvers
46+
47+
To create an access policy, your account must be assigned the *Intune Service Administrator* or *Azure Global Administrator* role.
48+
49+
To be an approver, an account must be in the group that’s assigned to the access policy for a specific type of resource.
50+
51+
## How multi admin approval and Access policies work
52+
53+
**When an admin edits** or creates a new object for an area that’s protected by an access policy, they see an option on the *Save + Review* surface where they can enter a description of the change as a *business justification*.
54+
55+
- The *business justification* becomes part of the approval request for the change.
56+
- An admin who has submitted a change can view the status of their requests in the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/) by going to **Tenant administration** > **Multi Admin Approval** and viewing the **My request** page.
57+
58+
**After a change is submitted**, an *approver* navigates to the **Received request** page of the **Multi Admin Approval** node. Here they’ll see a list of requests that are active, or recently managed. This view provides some details about the request including when and who submitted it, the type of operation involved like *Create* or *Assign*, and its status. To manage the request:
59+
60+
- The approver selects the *Business justification* link for the request. This action opens the Access policy request pane where you can view more information about the change, including the full details provided in the Business justification field of the request.
61+
- On the Access policy request pane, the approver can enter notes in the **Approver notes** field, and then select an option to **Approve request** or **Reject request**. These notes are added to the request and are visible to the individual who requested the change when they review their requests on the **My request** page. For example, if the request is rejected, the reason for the rejection can be passed back to the requestor through the Approver notes.
62+
- Individuals who submit a request and are also members of the approval group for that can see their own requests on the Received request page. However, they can't approve their own requests.
63+
64+
**If a change is approved**, Intune processes the requested change and updates the object. While Intune processes the request, its status can display as **Approved**. After it’s successfully processed, the status updates to **Completed**.
65+
66+
**Each change of status** remains visible for up to 30 days after the last change of status. If a request isn’t processed further within 30 days, it becomes **Expired**, and must be resubmitted.
67+
68+
## Create an access policy
69+
70+
1. To create an access policy, in the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/), go to **Tenant administration** > **Multi Admin Administration** > **Access policies** and select **Create**.
71+
72+
2. On the *Basics* page, provide a *Name*, and optional *Description*, and for *Profile type* select from available options. Each policy supports a single profile type.
73+
74+
<!-- The following screen capture shows a new policy with **Apps** selected for the profile type. -->
75+
76+
3. On the *Approvers page*, select **Add groups** and then select a group as the group of approvers for this policy. More complex configurations that exclude groups aren't supported.
77+
78+
4. On the *Review + Create* page, review, and then save your changes. After Intune applies this policy, configurations for the protected profile type will require multiple admin approvals.
79+
80+
## Submit a request
81+
82+
To submit a request when MAA is enabled, use your normal process to create or edit a resource.
83+
84+
On the final page before you can save your changes, add details to the *Business justification* field and then submit the request. For urgent requests, consider reaching out to a known list of approvers to ensure your request is seen in a timely manner.
85+
86+
When there's a request for the same object that is already pending approval, you won't be able to submit your request. Intune displays a message to alert you to this situation.
87+
88+
To monitor the status of your requests, in the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/) go to **Tenant administration** > **Multi Admin Approval** > **My requests**.
89+
90+
You can cancel a request before it’s approved by selecting it from the My requests page, and then selecting **Cancel request**.
91+
92+
## Approve requests
93+
94+
1. To find requests to approve, in the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/) go to **Tenant administration** > **Multi Admin Administration** > **Received requests**.
95+
96+
2. Select the *Business justification* link for a request to open the review page where you can learn more about the request, and manage approval or rejection.
97+
98+
3. After reviewing the details, enter relevant details in the Approver notes field, and then select **Approve request** or **Reject request**.
99+
100+
4. After you approve a request, Intune processes the change and updates the status to *Completed* after it’s successfully applied. The request status might change to *Approved* for a limited time if the update to the resource takes time to process.
101+
102+
## More considerations
103+
104+
- With the public preview, Intune doesn't send notifications when new requests are created, or the status of an existing request changes. We recommend that when submitting an urgent change request, you reach out to individuals who have permission to approve those requests.
105+
106+
- Plan to monitor the status of your requests through the *My requests* page of the *Multi Admin Approval* node in the Microsoft Endpoint Manager admin center.
107+
108+
- When an approval is already pending for an object, a new request is can't be submitted for it.
109+
110+
- All actions for a protected resource are protected, including but not limited to:
111+
- Edit
112+
- Create
113+
- Modify
114+
- Delete
115+
- Assign
116+
117+
- Actions for requests and the approval process are logged in the Intune audit logs. For more information, see [Audit logs for Intune activities](../fundamentals/monitor-audit-logs.md).
118+
119+
- The following status conditions are available for a request:
120+
- Needs approval – This request is pending action by an approver.
121+
- Approved – This request is being processed by Intune.
122+
- Completed – This request has been successfully applied.
123+
- Rejected – This request was rejected by an approver.
124+
- Canceled – This request was canceled by the admin who submitted it.
125+
126+
## Next steps
127+
128+
Manage [role-based access control](../fundamentals/role-based-access-control.md)

memdocs/intune/fundamentals/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,8 @@ items:
186186
href: create-custom-role.md
187187
- name: Use scope tags
188188
href: scope-tags.md
189+
- name: Configure multiple admin approval
190+
href: multi-admin-approval.md
189191
- name: Enroll devices
190192
href: ../enrollment/index.yml
191193
- name: Remotely manage devices

memdocs/intune/protect/microsoft-tunnel-configure.md

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ keywords:
55
author: brenduns
66
ms.author: brenduns
77
manager: dougeby
8-
ms.date: 08/03/2022
8+
ms.date: 08/17/2022
99
ms.topic: how-to
1010
ms.service: microsoft-intune
1111
ms.subservice: protect
@@ -172,12 +172,22 @@ Before installing Microsoft Tunnel Gateway on a Linux server, configure your ten
172172

173173
2. After Microsoft Tunnel Gateway registers with Intune, the script gets information about your Sites and Server configurations from Intune. The script then prompts you to enter the GUID of the tunnel Site you want this server to join. The script presents you with a list of your available sites.
174174

175-
3. After you select a Site, setup pulls the Server configuration for that Site from Intune and applies it to your new server to complete the Microsoft Tunnel installation.
175+
3. After you select a Site, setup pulls the Server configuration for that Site from Intune, and applies it to your new server to complete the Microsoft Tunnel installation.
176176

177177
7. After the installation script finishes, you can navigate in Microsoft Endpoint Manager admin center to the **Microsoft Tunnel Gateway** tab to view high-level status for the tunnel. You can also open the **Health status** tab to confirm that the server is online.
178178

179179
8. If you’re using RHEL 8.4 or 8.5, be sure to restart the Tunnel Gateway server by entering `mst-cli server restart` before you attempt to connect clients to it.
180180

181+
### Configure a break and inspect proxy
182+
183+
After installing the Microsoft Tunnel server, you can then configure Microsoft Tunnel to work with a break and inspect proxy server that uses a self-signed certificate. To be successful, Microsoft Tunnel must be able to locate and access the certificate from the Proxy server.
184+
185+
Configuration requires the following steps:
186+
187+
1. The proxy server certificate must be in *PEM* format and saved to a file with a `.crt` extension.
188+
2. Copy the *.crt* file to the following location on the Linux host: `/etc/mstunnel/ca-trust`
189+
3. Re-run the installation script.
190+
181191
## Deploy the Microsoft Tunnel client app
182192

183193
To use the Microsoft Tunnel, devices need access to a Microsoft Tunnel client app. You can deploy the tunnel client app to devices by assigning it to users. The following apps are available:

memdocs/intune/protect/microsoft-tunnel-overview.md

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -144,18 +144,20 @@ The Microsoft Tunnel Gateway runs in containers that run on Linux servers.
144144

145145
Many enterprise networks enforce network security for internet traffic using technologies like proxy servers, firewalls, SSL break and inspect, deep packet inspection, and data loss prevention systems. These technologies provide important risk mitigation for generic internet requests but can dramatically reduce performance, scalability, and the quality of end user experience when applied to Microsoft Tunnel Gateway and Intune service endpoints.
146146

147-
The following outlines where break and inspect is not supported and where it is supported with Microsoft Tunnel Gateway. References are to the architecture diagram from the preceding section.
147+
The following outlines where break and inspect isn't supported and where it's supported with Microsoft Tunnel Gateway. References are to the architecture diagram from the preceding section.
148148

149149
- **Break and inspect is not supported in the following areas**:
150150

151-
- Tunnel Gateway does not support SSL break and inspect, TLS break and inspect, or deep packet inspection for client connections.
152-
- The Use of firewalls, proxies, load balancers, or any technology that terminates and inspects the client sessions that go into the Tunnel Gateway is not supported and will cause clients connections to fail. (Refer to **F**, **D**, and **C** in the Architecture diagram).
153-
- If Tunnel Gateway uses an outbound proxy for internet access, the proxy server cannot perform break and inspect. This is because Tunnel Gateway Management Agent uses TLS mutual authentication when connecting to Intune (Refer to **3** in the Architecture diagram above). If break and inspect is enabled on the proxy server, network admins that manage the proxy server must add the Tunnel Gateway server IP address and Fully Qualified Domain Name (FQDN) to an approve-list to these [Intune endpoints](../fundamentals/intune-endpoints.md#access-for-managed-devices).
151+
- Tunnel Gateway doesn't support SSL break and inspect, TLS break and inspect, or deep packet inspection for client connections.
152+
- The Use of firewalls, proxies, load balancers, or any technology that terminates and inspects the client sessions that go into the Tunnel Gateway isn't supported and will cause clients connections to fail. (Refer to **F**, **D**, and **C** in the Architecture diagram).
153+
- If Tunnel Gateway uses an outbound proxy for internet access, the proxy server can't perform break and inspect. This is because Tunnel Gateway Management Agent uses TLS mutual authentication when connecting to Intune (Refer to **3** in the Architecture diagram above). If break and inspect is enabled on the proxy server, network admins that manage the proxy server must add the Tunnel Gateway server IP address and Fully Qualified Domain Name (FQDN) to an approve-list to these [Intune endpoints](../fundamentals/intune-endpoints.md#access-for-managed-devices).
154154

155155
- **Break and inspect is supported in the following area**:
156156

157157
The Microsoft Tunnel [client VPN profile](../protect/microsoft-tunnel-configure.md#create-a-vpn-profile) that gets delivered to mobile clients supports a proxy configuration. If using this setting, the proxy (Refer to **G** in the Architecture diagram) specified can use “Break and Inspect” on the client traffic routed out (refer to **7** in the Architecture diagram) of the Tunnel Gateway server to the corporate network.
158158

159+
Configuration of a break and inspect proxy can be completed after the initial Microsoft Tunnel installation. See [Configure a break and inspect proxy](microsoft-tunnel-configure.md#configure-a-break-and-inspect-proxy).
160+
159161
**Additional details**:
160162

161163
- Conditional Access is done in the VPN client and based on the cloud app *Microsoft Tunnel Gateway*. Non-compliant devices won’t receive an access token from Azure AD and can't access the VPN server. For more information about using Conditional Access with Microsoft Tunnel, see [Use Conditional Access with the Microsoft Tunnel](microsoft-tunnel-conditional-access.md).

0 commit comments

Comments
 (0)