OpenControls Logo

STIG Viewer

STIGViewer Support

The Intune service must be configured to implement Multi-Admin Approval (MAA) for wiping managed devices.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-285327MSIN-25-002000SV-285327r1211999_ruleCCI-000366high
Description
High-risk administrative actions, such as managed device wipe, should be configured to require dual authentication to mitigate the risk of an attacker that has bypassed malware protections and obtained legitimate Intune access. Satisfies: SRG-APP-000516-UEM-000391
STIGDate
Microsoft Intune MDM Service Desktop & Mobile Security Technical Implementation Guide2026-05-27

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (8) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-01Configuration Management Program
1.00
END-01Endpoint Device Management (EDM)
1.00
END-04Malicious Code Protection (Anti-Malware)
1.00
END-06Endpoint File Integrity Monitoring (FIM)
1.00
MON-01Continuous Monitoring
1.00
MON-01.7File Integrity Monitoring (FIM)
1.00
CFG-02Secure Baseline Configurations
0.50
CFG-02.7Approved Configuration Deviations
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-12Session Termination
1.00
AC-16(1)Dynamic Attribute Association
1.00
AC-17(1)Monitoring and Control
1.00
AC-2Account Management
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-24(1)Transmit Access Authorization Information
1.00
AC-25Reference Monitor
1.00

+90 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.4.1
1.00
3.4.2
1.00
CCI1 mapping
CCI-000366
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (5) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-09
1.00
PR.PS-01
1.00
PR.DS-10
0.50
PR.PSPlatform Security
0.50
PR.PS-05
0.50

Who does this work

10 NICE work roles and 9 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-285327r1211999_chk)

Use the following procedure to verify MAA has been set up for managed device wipe on the Intune service. 1. Verify a Microsoft 365 security group has been set up for device-wipe approval Administrators. - Sign in to Intune Admin Center: Navigate to Tenant administration >> Multi Admin Approval. - Verify the assigned "Approval Group" is in the access policy. 2. Verify an Access Policy has been created for "Device Wipe". - Verify Access Policies: Click on "Access policies" to view the policies created. - Check Policy Details: Select the policy created for device wipes to verify: - Policy Type: Must be set to Device Wipe. - Approver Group: Verify the correct Microsoft Entra security group is selected as the approver group. - Confirm Active Status: Verify the policy is active and not pending further approval of the policy itself. If the Intune service is not configured with a Microsoft 365 security group for device-wipe approval Administrators or is not configured with a device-wipe Access Policy, this is a finding.

Fix Text (F-89802r1211998_fix)

Note: All device-wipe processes and procedures must be compliant with DOD data retention policies for mobile devices. Note: This procedure requires two separate groups: one group of Administrators that request a managed device be wiped (requestor group) and one Administrator group that approves the request (approver group). Note: Two administrators are needed to set up MAA for managed device-wipe: one to set up the required approver group and the MAA device-wipe policy and one to approve the new policy. Implementing dual authorization in Intune for device wipes is achieved using MAA, which enforces a "four-eyes" policy, requiring a second admin to approve wipe requests. This process, found under Tenant Administration >> Multi Admin Approval, requires creating an access policy, assigning an approver group, and justifying the action. Steps to Implement Multi-Admin Approval for Wipes: 1. Prepare Groups: Create a Microsoft 365 security group containing the administrators allowed to approve requests, excluding the user who initiates the wipe. 2. Create Access Policy: - Sign in to the Microsoft Intune admin center. - Navigate to Tenant administration >> Multi Admin Approval >> Access policies. - Click "Create" and select "Device wipe" as the profile type. - Assign the approver group and complete the wizard. 3. Approve Policy: A second administrator must approve the newly created Access Policy before it becomes active. 4. Execute Wipe: When a device is wiped, the initiating admin provides a justification, and an approver approves it under Tenant administration >> Multi Admin Approval >> All requests. Key Considerations: - Approval Workflow: The requester must return to the Multi Admin Approval portal to "Complete request" after the second admin approves it. - License: Requires Microsoft Intune Plan 1. - Notifications: There is no built-in notification system; reviewers must check the console manually. A workflow should be created for the "requestor" Admin to notify the "approver" Admin that a device wipe request is ready for approval. - Limitation: The policy covers managed device wipes and is a best practice for preventing accidental data loss.