@ChikaraTaro Thanks for posting in our Q&A.
For this issue, it seems more related to Microsoft Entra ID, so I will add "Microsoft Entra ID " tag. Based on my search, I find the official article describes that
Updating the Microsoft Entra Joined Device Local Administrator role doesn't necessarily have an immediate impact on the affected users. On devices where a user is already signed in to, the privilege elevation takes place when both the below actions happen:
- Up to 4 hours passed for Microsoft Entra ID to issue a new Primary Refresh Token with the appropriate privileges.
- User signs out and signs back in, not lock/unlock, to refresh their profile.
For more details, please read the following article:
Hope it will give you some ideas.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.