Restore Intune with Multi Admin Approval

How does the native approval process affect recovery?

Microsoft Multi Admin Approval protects changes in areas covered by the tenant’s access policies. The approver reviews a request in Intune. It is sensible to include an available approver in the recovery plan rather than discovering during an incident that the only approver is unavailable.

TenuVault respects this process. Backups and other read operations continue to work, while protected same-tenant restores become requests. The normal Create copies or Replace in place choice still matters: approval does not change what the selected restore mode intends to write.

How do I restore Intune with Multi Admin Approval?

1. Choose the backup, items and restore mode as usual. In Review, enter a justification when the field appears. Include the incident or change reference and explain why the saved configuration is appropriate now. The field accepts up to 700 characters.

2. Run the reviewed restore. Unprotected items can restore directly. Each protected item shows Submitted for approval, with no write yet for that step. Read the individual results rather than assuming the whole selection has the same status.

3. Have an administrator in the access policy’s approver group approve the request in the Intune admin center. Approval and rejection remain there. The requester cannot approve their own request, so coordinate the handoff with the named second administrator.

What do I do after the request is approved?

Open Waiting for approval in TenuVault. When the request shows Approved, ready to complete, select Complete. Use the same installation that submitted it and sign in as the original requester. Keep that installation’s data until the work is complete: the list is not a tenant-wide list of every pending request.

For replacement, TenuVault checks whether the live object changed while the request waited. If it did, review the current policy and start a fresh restore rather than overwriting someone else’s intervening change. Completion sends the approved change and records the outcome.

Why can restoring assignments require another approval?

A policy restore with assignments can have two rounds. The first creates or updates the policy. The assignment step is then submitted automatically for approval and appears as Step 2 of 2. Have the approver review that request and return to TenuVault to complete it too.

During that wait, a recreated policy or copy exists without the restored assignments. A replaced Settings Catalog policy already has the restored settings and keeps its current assignments. Devices in those groups may therefore receive the recovered settings before the assignment round finishes. Plan that intermediate state explicitly.

How can I try this on my tenant?

Download TenuVault and rehearse with an approved protected test policy and an available approver. Record submission, approval and completion as separate milestones. Test the assignment round only with a small test group, and check the intermediate policy state before asking for its second approval.

If the wizard could not read access policies or no justification was submitted, an item can end as Approval required. Open Waiting for approval, supply the justification and submit it there. Review rejected or expired requests before starting again. Never label a waiting or approved request as a completed recovery.

• Restore workflow and plan options
• Practice a restore drill
• Recover a deleted policy
• Microsoft Multi Admin Approval workflow
• Download TenuVault