Note: All device-wipe processes and procedures must be compliant with DOD data retention policies for mobile devices.
Note: This procedure requires two separate groups: one group of Administrators that request a managed device be wiped (requestor group) and one Administrator group that approves the request (approver group).
Note: Two administrators are needed to set up MAA for managed device-wipe: one to set up the required approver group and the MAA device-wipe policy and one to approve the new policy.
Implementing dual authorization in Intune for device wipes is achieved using MAA, which enforces a "four-eyes" policy, requiring a second admin to approve wipe requests. This process, found under Tenant Administration >> Multi Admin Approval, requires creating an access policy, assigning an approver group, and justifying the action.
Steps to Implement Multi-Admin Approval for Wipes:
1. Prepare Groups: Create a Microsoft 365 security group containing the administrators allowed to approve requests, excluding the user who initiates the wipe.
2. Create Access Policy:
- Sign in to the Microsoft Intune admin center.
- Navigate to Tenant administration >> Multi Admin Approval >> Access policies.
- Click "Create" and select "Device wipe" as the profile type.
- Assign the approver group and complete the wizard.
3. Approve Policy: A second administrator must approve the newly created Access Policy before it becomes active.
4. Execute Wipe: When a device is wiped, the initiating admin provides a justification, and an approver approves it under Tenant administration >> Multi Admin Approval >> All requests.
Key Considerations:
- Approval Workflow: The requester must return to the Multi Admin Approval portal to "Complete request" after the second admin approves it.
- License: Requires Microsoft Intune Plan 1.
- Notifications: There is no built-in notification system; reviewers must check the console manually. A workflow should be created for the "requestor" Admin to notify the "approver" Admin that a device wipe request is ready for approval.
- Limitation: The policy covers managed device wipes and is a best practice for preventing accidental data loss.