How to Control Local Administrator Rights for Azure AD Joined Devices
Question details
The user needs to manage and restrict local administrator privileges that are automatically granted when users join a device to the organization's Azure AD (Microsoft Entra ID).
- Product
- Azure Active Directory
- Device & OS
- not provided
- Scenario
- Configuring device-join settings and administrator privileges to secure devices across an organization.
- Observed behavior
- Users automatically receive local administrator rights upon joining devices to the organization's Azure AD, which requires policy restrictions.
Ensure you have Global Administrator or Privileged Role Administrator permissions in your Microsoft Entra ID tenant to modify global device settings.
Configure Microsoft Entra ID Device Settings
Adjust the global device settings in your Microsoft Entra admin center to specify who receives local administrator rights upon joining a device.
By default, the user who performs the Azure AD join is added to the local administrators group. You can modify these global settings to restrict who gets these privileges across your tenant.
Log in to the Microsoft Entra admin center as at least a Cloud Device Administrator.
In the left-hand navigation pane, go to Devices, then select Device settings.
Locate the 'Additional local administrators on Microsoft Entra joined devices' setting. Click 'Selected' to choose specific trusted users or groups, or select 'None' to prevent additional assignments.
Click 'Save' at the top of the page to apply the new local administrator policies across your tenant.
Manage Local Admins via Microsoft Intune Policies
Use Intune's Endpoint Security policies to granularly manage local group memberships and administrators on a per-device or per-group basis.
Consult Microsoft Q&A Community
If you have complex, tenant-specific configuration requirements, leverage Microsoft's official community forums for expert guidance.
Optimize Your Managed Devices with WPS Office
While you manage complex IT policies and device configurations in Microsoft Entra ID, consider optimizing your organization's software deployment. WPS Office is a free, lightweight, and highly compatible alternative to Microsoft Office that offers a familiar user interface and seamless migration for your workforce.
- 1. Download the Installer: Visit the official WPS Office website to download the lightweight enterprise or free installer.
- 2. Deploy to Devices: Use your preferred MDM solution, such as Microsoft Intune, to deploy the WPS Office package to your managed devices.
- 3. Open and Edit Securely: Allow your users to open, edit, and save legacy Microsoft Office files securely without expensive licensing.
Frequently Asked Questions
Who gets local administrator rights by default during Azure AD join?
By default, the user who performs the Azure AD join process is granted local administrator rights on that specific device. Additionally, users assigned the Global Administrator and Cloud Device Administrator roles in Entra ID are added to the local administrators group on all joined devices.
Can I remove local admin rights from existing Azure AD joined devices?
Yes, but modifying the global Entra ID device settings will not affect already joined devices. To remove local admin rights from existing devices, you must use Microsoft Intune's 'Local user group membership' policies, custom OMA-URI settings, or PowerShell scripts deployed to the devices.
Does standard Azure AD registration grant local admin rights?
No. When a device is merely 'Azure AD registered' (such as a personal BYOD device), the user is not automatically granted local administrator rights through Entra ID. This behavior is specific to 'Azure AD joined' or 'Hybrid Azure AD joined' corporate devices.
