Need to add entra user / group to a vm local admin group

Question

I am trying to add an entra security group to a vm local admin group. It can't find the name from the VM computer management and logged in as local admin

Answer 1

Your VM would have to be Entra joined

Once you join it, follow https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin

Manually elevate a user on a device

In addition to using the Microsoft Entra join process, you can also manually elevate a regular user to become a local administrator on one specific device. This step requires you to already be a member of the local administrators group.

Starting with the Windows 10 1709 release, you can perform this task from Settings -> Accounts -> Other users. Select Add a work or school user, enter the user's user principal name (UPN) under User account and select Administrator under Account type

Additionally, you can also add users using the command prompt:

• If your tenant users are synchronized from on-premises Active Directory, use net localgroup administrators /add "Contoso\username".
• If your tenant users are created in Microsoft Entra ID, use net localgroup administrators /add "AzureAD\UserUpn"

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

Hello @Jose Calderin,

The user reports that when they run the command net localgroup administrators on the virtual machine (VM), it only shows the local admin account that was originally created, and not the Azure AD (Entra ID) user or group they tried to add. This likely means the VM is not joined to Azure AD, the user or group name was entered incorrectly, or additional configuration is required to allow Azure AD accounts to be added as local administrators.

For Azure AD users or groups to be added to local groups on a VM, the VM must be either Azure AD joined, or Hybrid Azure AD joined. If the VM is not joined in this way, the system won't be able to recognize or resolve Azure AD accounts, and they cannot be added to local groups.

Answer 3

Hi Jose Calderin,

Thanks for posting your question on the Q&A portal! To add an Entra ID (formerly Azure AD) user or group to a VM’s local admin group, you’ll need to use Azure AD authentication and ensure the VM is properly joined to Azure AD.

Here are some helpful docs:

Azure AD login for Windows VMs

Assign local admin roles via Azure AD groups

If the VM isn’t Azure AD-joined, you’ll need to set that up first. Let me know if you run into issues!

Best regards,
Alex
P.S. If my answer help to you, please Accept my answer
PPS That is my Answer and not a Comment