MAA now intercepts Graph API calls — and why read-only never sees it
My automation broke in June with a 403 I'd never seen before. Not Authorization_RequestDenied — I
know that one, that's a missing scope. This was ApprovalRequired, and my first instinct was that
Microsoft had shipped a new permission I hadn't consented to yet. It hadn't. What shipped was a change to
Multi Admin Approval (MAA) — previously an interactive-admin-only gate — that extended it to
app-authenticated Graph calls. If your tenant has an MAA access policy on a protected workload, your
service principal now hits exactly the same wall a human admin does.