Convert user from Local Administrator to Standard user in Azure joined device

Question

I'm wanting to convert local administrators to standard on Azure AD joined devices.

Answer 1

@Chet Biggers ,

The guide How to manage the local administrators group on Azure AD joined devices covers the best practices for this scenario. Under Azure Active Directory > Devices > Device Settings > Manage Additional local administrators on all Azure AD joined devices , you can add or remove Device Administrators.

If you want to prevent regular users from becoming local administrators, you have the following options:

• Windows Autopilot - Windows Autopilot provides you with an option to prevent primary user performing the join from becoming a local administrator by creating an Autopilot profile.
• Bulk enrollment - An Azure AD join that is performed in the context of a bulk enrollment happens in the context of an auto-created user. Users signing in after a device has been joined aren't added to the administrators group.

This Reddit thread also has a sample script that removes the users from the local admins group, though I have not tested this.

Let me know if this addresses your ask and if you have further questions.

If the information helped you, please Accept the answer. This will help us as well as others in the community who may be researching similar questions.