AzureAD joined devices - device administration

Question

Good day, I have been looking to see if there is a way to remove the "Device Administrator" role.

I log into the device with my work microsoft account, naturally this will AzureAD join the device, and assigned my account as a "Device Administrator"

As a business we are currently doing the UK certification for Cyber Essentials. As part of that, everyday accounts should NOT be part of the administrator group, which in turn means that the microsoft account can't be a "Device Adminstrator".

Is there anyway we can remove that "Device Administrator" and prevent future accounts for AzureAD joined devices from having that role?

We have AzureAD Free, M365 and 5 intune licenses (which I will be using for testing).

I have created a local administrator account

Answer 1

Hi Liam,

If the device is set to automatically enrol in Endpoint manager (which it likely will be) then you can configure account protection. Check out the options here > https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-account-protection-policy

No need to then go an install the company portal app if the device is enrolled in Intune.

Let me know if this helps!

Cheers

Dan

https://ourcloudnetwork.com

Answer 2

@Liam Fermoyle, Thanks for posting in Q&A.

In fact, when the device is configured automatic enrollment and go to Access work or school to do Azure AD join, the device will be enrolled into Intune automatically. And the enrolled user will be added into local administrators group by default.

To remove it, you can refer to the link in Daniel Bradley's reply to modify the local administrators membership to only keep the users you want.

Fo the device enrolled in the future; you can choose Autopilot enrollment which has the option to choose the user's account type as a standard user when configure autopilot enrollment profile. For more details, you can read the following link:

https://learn.microsoft.com/en-us/mem/autopilot/profiles

Hope it can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.