TenuVaultDesktopComparison
Multi Admin Approval or an Intune backup
Multi Admin Approval (MAA) makes a second administrator approve changes to protected Intune objects before they apply. It is one of the best protections Intune has against an accidental delete. It is prevention, not recovery: an approved mistake still applies, and nothing in MAA keeps the previous version. This page compares it with a backup.
At a glance
- Multi Admin Approval protects apps (deployments, not app protection policies), compliance policies, settings catalog configuration policies, Windows scripts, role-based access control, device categories and device actions such as wipe, retire and delete.
- For a protected object, every action needs approval, including create, edit, delete and assign.
- Multi Admin Approval applies to admin actions through Microsoft Graph too, both delegated and app-authenticated calls, so restores and scripts need the same approval.
- An administrator cannot approve their own request, and a request expires after three days.
- Microsoft describes no copy, version history or restore in Multi Admin Approval. An approved change applies like any other.
- TenuVault backs up Multi Admin Approval policies themselves, along with the objects they protect.
Side by side
| Question | Multi Admin Approval | TenuVault backup |
|---|---|---|
| What it does | Stops a change until a second admin approves it | Keeps copies so a change can be undone later |
| Cost | Part of Intune; participating admins need an Intune license by default | Community is free for one tenant; Pro and MSP are paid |
| Object types | Apps, compliance, settings catalog, Windows scripts, RBAC, device categories and device actions | 40 Intune object types in nine areas, with their assignments where Intune has them |
| An approved mistake | Applies | Can be restored from a backup made before it |
| Unprotected types, such as app protection policies | Not covered | Backed up like the rest |
| Speed of a change | Waits for an approver, up to three days | No effect on how changes are made |
| Record | Approval requests with the requester and the approver | Dated copies and a comparison of what changed |
What Multi Admin Approval does well
MAA closes the most common gap: one admin deleting or changing a protected policy alone, by mistake or on purpose. Because it also applies to Graph calls made by apps, a compromised script or token cannot skip it unless that app was excluded from the policy.
For a tenant that cannot tolerate an unreviewed change to compliance or settings catalog policies, MAA is worth turning on whether or not you also have a backup.
What it does not cover
These are not flaws; MAA is designed to stop changes, not to keep copies.
- An approver can approve a change that turns out to be wrong. It applies, and MAA has nothing to restore it from.
- Types outside its list, such as app protection policies, enrollment configurations and many older profile types, can be changed without approval.
- It keeps no previous version, so it cannot show what a policy looked like last month.
- It does not protect against changes made before it was turned on.
How the two work together
A backup covers what MAA cannot: approved mistakes, unprotected types and the full previous version. MAA covers what a backup cannot: stopping the change before devices receive it.
Plan for one interaction. TenuVault writes to Intune with the signed-in admin's account, so restoring a protected type is a change like any other and needs the same approval. Include the approval step in your recovery plan, and make sure an approver is reachable when you need to restore.
TenuVault also backs up your Multi Admin Approval policies themselves, so a deleted or changed MAA policy can be seen and restored. Community restores one item at a time as a new, unassigned copy.
When you do not need TenuVault
MAA on its own can be enough when:
- Every type you care about is on its protected list, and approvers review changes carefully.
- You have a documented configuration you could rebuild from if an approved change goes wrong.
- Changes are rare enough that each one gets a real review.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Does Multi Admin Approval back up Intune policies?+
No. Multi Admin Approval requires a second administrator to approve changes to protected objects. Microsoft describes no copy, version history or restore, so an approved change applies and the previous version is gone unless you have a backup.
Which Intune objects can Multi Admin Approval protect?+
Apps (deployments, not app protection policies), compliance policies, settings catalog configuration policies, Windows scripts, role-based access control, device categories and device actions such as wipe, retire and delete. Every action on a protected object needs approval.
Does Multi Admin Approval apply to restores made by a backup tool?+
Yes. Microsoft applies it to delegated admin actions and to app-authenticated Graph calls. TenuVault restores with the signed-in admin's account, so restoring a protected type needs the same approval as any other change.
Should I use Multi Admin Approval and a backup?+
For most tenants, yes. Multi Admin Approval stops unapproved changes to protected types. A backup recovers from approved mistakes and from changes to types Multi Admin Approval does not protect.