MAA now intercepts Graph API calls — and why read-only never sees it
My automation started failing on a write with a status code I did not expect: 412 Precondition
Failed. Not 403 Authorization_RequestDenied — I know that one, that's a missing scope. A 412, on a
POST to Intune, telling me a precondition hadn't been met. The precondition, it turned out, was a
second admin's approval. What had changed was Multi Admin Approval (MAA) — previously an
interactive-admin-only gate — extended to app-authenticated Graph calls. If your tenant has an MAA
access policy on a protected workload, your service principal now hits the same wall a human admin does.