'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix Global Administrator Cannot Elevate Apps on Azure AD Devices
Question details
The user is unable to elevate applications on Azure AD-joined devices despite having the Microsoft Entra Global Administrator role.
- Product
- Microsoft Entra / Azure AD
- Device & OS
- not provided
- Scenario
- Attempting to run applications with administrative privileges on an Azure AD-joined device.
- Observed behavior
- The Global Administrator does not automatically retain local administrator access and fails to elevate app permissions.
Ensure you have access to the Microsoft Entra admin center and verify whether the affected devices are enrolled in Microsoft Intune before making any policy changes.
Check Device Local Administrator Role Assignments
Verify and assign the correct local administrator roles for Azure AD-joined devices in Microsoft Entra to ensure proper elevation rights.
A Microsoft Entra Global Administrator does not automatically have local administrator rights on all joined devices unless explicitly configured. You must check the specific role assignments.
Navigate to the Microsoft Entra admin center using an account with sufficient privileges to manage roles.
Go to 'Devices' > 'All devices' > 'Device settings' from the main dashboard to review the current local administrator configurations.
Under 'Additional local administrators on Microsoft Entra joined devices', ensure the 'Microsoft Entra joined device local administrator' role is assigned to the users who need to elevate applications.
Review Microsoft Intune Endpoint Security Policies
Check Microsoft Intune configurations that might be overriding local administrator groups on enrolled devices.
Seek Assistance in Microsoft Azure Community
If role assignments and Intune policies are correct, consult with Azure experts to investigate complex device administration issues.
Looking for a Manageable and Secure Office Suite? Try WPS Office
While troubleshooting complex Azure AD device policies and local administrator rights, ensure your organization has a reliable, highly compatible, and easy-to-deploy office suite. WPS Office is a lightweight and powerful solution for your document needs.
- 1. Visit the official website: Go to the WPS Office official website to access the secure installation packages.
- 2. Download the installer: Click the 'Free Download' button to get the lightweight setup file suitable for your device.
- 3. Install and deploy: Run the installer to deploy WPS Office seamlessly without requiring complex local administrator tweaks for basic usage.
Frequently Asked Questions
Why doesn't a Global Administrator have local admin rights on devices by default?
By default, Microsoft Entra Global Administrators do not automatically retain local administrator rights on all joined devices to enforce security principles of least privilege. Permissions must be managed via specific device local administrator roles or Intune policies.
Can I use Microsoft Intune to manage local administrators?
Yes, you can manage local administrators on Azure AD-joined devices using the Local User Group Membership policies found within the Endpoint security section of the Microsoft Intune admin center.
How do I check my currently assigned roles in Microsoft Entra?
Sign in to the Microsoft Entra admin center, go to 'Users', select your user profile, and click on 'Assigned roles' to view the active administrative permissions applied to your account.
Do I need to restart the device after changing local admin roles?
Yes, users typically need to sign out and sign back in, or restart the device entirely, for new local administrator role assignments or group memberships to be successfully applied to the device token.
