Autopilot Deployment profile OOBE User Account type Administrator is not created under Administrator group

Question

In Deployment profile OOBE I have set user account type Administrator. But post Autopilot provision completion sucessful I don't see user is added to Administrator group. How to troubleshoot why user is not added to Administrator group. Please explain me which MDM Diagnostic logs I need refer. I looked all the logs but I didn't get any trace. I checked couple of event viewer entry I got some info but it does not helped me. please suggest. Attached reference screenshot.

Answer 1

Keeping your issue aside, may I suggest that giving your end users admin rights is a very idea and you are potentially opening the attack surface area? Instead, you should look at implementing cloud LAPS.

Answer 2

What is the value of “Registering user is added as local administrator on the device during Microsoft Entra join” under Entra>Devices?

Answer 3

@Imran Katike, Thanks for posting in Q&A. Based on my researching, there's a compatibility problem between the Windows Autopilot device preparation policy User account type setting and the Microsoft Entra ID Local administrator settings. I notice we want the user to be a local administrator user on the device. If so, please set the Microsoft Entra ID Local administrator settings is set to All.

https://learn.microsoft.com/en-us/autopilot/device-preparation/known-issues#conflict-between-microsoft-entra-id-and-windows-autopilot-device-preparation-local-administrator-setting

Meanwhile, if it occurs in Windows Autopilot user-driven hybrid Microsoft Entra deployments and there's another user on the device that already has Administrator rights, it will also cause the issue. Please don't create another account until after the Windows Autopilot process is complete.

https://learn.microsoft.com/en-us/autopilot/known-issues#windows-autopilot-user-driven-hybrid-microsoft-entra-deployments-dont-grant-users-administrator-rights-even-when-specified-in-the-windows-autopilot-profile

Please try the above suggestion and if there's any update, feel free to let us know.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.