Local administrator settings - Entra

Question

Are there any Microsoft documentation that explains these settings within Entra? There is this article, however it does not explain these preview items.

Answer 1

Hello Marcos,
Two new settings have been introduced in the Microsoft Entra device settings portal, enhancing control over which users are added to the local administrators group during the Microsoft Entra registration phase when joining a device. These settings are:

1. **Global Administrator Role as Local Administrator-:**This setting determines whether the Microsoft Entra Global Administrator role is automatically added to the local administrators group when devices are joined to Microsoft Entra. Disabling this setting is recommended to adhere to the principle of least privilege.
2. **Registering User as Local Administrator-:**This setting controls whether the user who registers the device is automatically added to the local administrators group during the Microsoft Entra join process. Disabling this setting allows for more granular control over which users are granted local administrator privileges during device registration.

By configuring these settings appropriately, organizations can better manage local administrator access and enhance security during the device enrolment process.

This option requires Microsoft Entra ID P1 or P2 licenses.

How to manage local administrators on Microsoft Entra joined devices - Microsoft Entra ID | Microsoft Learn

Answer 2

Hello @Marcos Correa

Thank you for contacting the Q&A Forum. For your question, both Global Administrator Role as Local Administrator and Registering User as Local Administrator are covered in the link that you provided. It’s in the “How it work” part. You could learn more if you put your mouse on the information icon here:

But if you need a more clarified explanation:

• Global Administrator Role as Local Administrator

Description: This setting determines whether the Microsoft Entra Global Administrator role is automatically added to the local administrators group when devices are joined to Microsoft Entra. Disabling this setting is recommended to adhere to the principle of least privilege. By default, the Global Administrator role is added to the local administrators group on a device when it is joined to Microsoft Entra ID.

Purpose: This provides full device control to global admins, but disabling this setting is recommended to follow the principle of least privilege.

Registering User as Local Administrator

Description: This setting controls whether the user who registers the device is automatically added to the local administrators group during the Microsoft Entra join process. Disabling this setting allows for more granular control over which users are granted local administrator privileges during device registration. The user who performs the Microsoft Entra join is automatically added to the local administrators group on the device.

Control: This behavior can be disabled in the Device Settings section of the Entra admin center to prevent regular users from gaining admin rights.

To learn more about these roles, kindly visit these links:

• https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#global-administrator
• https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#microsoft-entra-joined-device-local-administrator
• https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin

Please let me know if you have any further questions. If I have answered your question, please accept this as answer as a token of appreciation and don't forget to give a thumbs up for "Was it helpful"!

Best regards,

Megan.