'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Change an Intune Device Account from Administrator to Standard User
Question details
Administrators need to change the local account type on Microsoft Intune-managed devices from Administrator to Standard User.
- Product
- Microsoft Intune
- Device & OS
- not provided
- Scenario
- Restricting local permissions for users on corporate devices managed through Microsoft Intune.
- Observed behavior
- The correct steps to demote accounts to standard users depend heavily on specific enrollment methods, join types, and Entra ID configurations.
Verify your specific Intune enrollment method and Microsoft Entra ID join type before attempting to modify device account permissions.
Consult Microsoft Intune and Entra ID Support
Because changing account types relies heavily on your specific deployment architecture, the most reliable approach is to consult official Microsoft support channels with your exact configuration details.
The necessary steps to demote a local administrator to a standard user vary depending on whether the device is Microsoft Entra joined, Microsoft Entra hybrid joined, or personally registered.
To get accurate guidance tailored to your environment, utilize Microsoft's dedicated Q&A and Community Hubs where engineers specializing in Azure AD and Intune can provide exact policy configurations.
Check your Microsoft Intune admin center to note the enrollment method and whether the target devices are Microsoft Entra joined or Hybrid joined.
Open your web browser and go to the Microsoft Q&A portal or the Intune section of the Microsoft Community Hub.
Submit your specific scenario and ensure you tag your post with 'Azure Active Directory' or 'Microsoft Entra ID' so it reaches the correct technical specialists.
Need a Lightweight Office Suite for Your Managed Devices?
While configuring device management policies in Intune, ensure your standard users have access to efficient productivity tools. WPS Office is a free, highly compatible alternative to Microsoft Office that is easy to deploy across managed environments.
- 1. Download the Installer: Visit the official WPS Office website to download the standard or enterprise installation package.
- 2. Deploy via Intune: Package the WPS Office installer and deploy it seamlessly to your standard user groups via Microsoft Intune policies.
Frequently Asked Questions
Why should I change Intune device accounts to standard users?
Changing user accounts to standard users enhances endpoint security. It prevents unauthorized software installations, stops malware from gaining system-level access, and restricts users from making system-wide configuration changes.
Can I bulk demote local administrators using Intune?
Yes, enterprise administrators can manage and demote local administrator groups across multiple devices using Intune's Endpoint Security policies, Local User Group Membership policies, or custom OMA-URI settings.
How does the device join type affect account permission changes?
The necessary administrative steps differ based on your specific infrastructure. Microsoft Entra joined devices require different Intune policy configurations compared to Microsoft Entra hybrid joined devices or locally registered devices.
