'Registering user is added as local administrator on the device during Microsoft Entra join' confusion/terror - how does this work? how do we validate?

Question

'Registering user is added as local administrator on the device during Microsoft Entra join' confusion/terror - how does this work? how do we validate?

Ben Jenkins 0

Stumbled on a tenant with 'JOIN' available for all users. Haven't worked with this much - most tenants I see only have registration. But then I noticed the horrifying 'Registering user is added as local administrator on the device during Microsoft Entra join' option was ALSO set to ALL.
User's image

This is a tenant we just took on, but I've never seen that control before. This is terrifying, considering AFAIK, there is no real way for a registering user to know if they're registering or joining. Beneath it is an option to 'Manage Additional local administrators on all Microsoft Entra joined devices', which leads to the Role page for Device Administrators, which is empty.
User's image

Under Description, this describes what APPEARS to be to be the same thing mentioned in the previous control - 'Users with this role become local machine administrators on all Windows 10 devices that are joined to Microsoft Entra'. But no one is assigned this.

Conveniently, on my own tenant, I happened to let someone JOIN yesterday. We have this limited to 2 (now 3) people - most just register... But this user Joined, and the 'Joining user becomes local admin' option was on ALL. But I can't validate that the user ever become local admin. 1. They're no tin that 'Device Administrators' group, which describes itself as 'Users with this role become local machine administrators on all Windows 10 devices that are joined to Microsoft Entra'. Assuming this is a 3RD 'auto-admin' option separate from the Global Admin + Joining User options, I check the registration logs - in Entra. Nothing I see indicates any role being assigned. The User has no special roles, the Device has no special roles. Conveniently, I ALSO have an RMM tool on the device. It's offline rn, but as of last audit, that user is NOT admin. (She doesn't even show up)

Thoughts? Freaking out, honestly. We have a mix of DC and Cloud users. I've inherited them all, and had the understanding that Join was essentially registration but with Org ownership.

Does that option actually set the joining user as global admin? Is that really the default setting?
can you validate this ANYWHERE in Entra? Or does it just disappear?
what is that Device Admin group? A separate group, independent of these two settings, that gives local admin?

Thanks

Sridevi Machavarapu 33,740 Reputation points Microsoft External Staff Moderator

2026-04-22T20:24:37.9266667+00:00
Hello Ben Jenkins,

This is actually 3 different settings:

Global Administrator setting → Global Admins become local administrators on Microsoft Entra joined devices

Registering/Joining user setting → if set to All, the user who performs the Microsoft Entra join becomes local administrator on that specific device only

Device Administrators role → separate built-in role that gives local admin access on all Microsoft Entra joined devices

So the empty Device Administrators page is normal. It does not show users who became local admin by joining their own device.

This does not make the user a Global Administrator. It only grants local admin rights on that device, not tenant-wide admin rights.

It also does not appear as a normal Entra role assignment, which is why you won’t see it in role assignments, audit logs, or under Device Administrators.

The best way to verify is directly on the device:

Get-LocalGroupMember -Group "Administrators"

or

net localgroup administrators

Also confirm the device is actually Microsoft Entra joined and not just registered, because this setting applies only to joined devices.

The Device Administrators role is separate and tenant-wide, while the “joining user becomes admin” setting is automatic and device-specific.

Older tenants often had this set to All by default, so many admins are surprised when they first notice it.
Sridevi Machavarapu 33,740 Reputation points Microsoft External Staff Moderator

2026-04-23T20:34:16.6+00:00

Hello Ben Jenkins,

Any update on this? Please confirm if you still have further queries.
Raja Pothuraju 47,730 Reputation points Microsoft Employee Moderator

2026-04-28T09:25:37.4+00:00

@Ben Jenkins, Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.

1 answer

Your answer

Sridevi Machavarapu 33,740 Reputation points Microsoft External Staff Moderator

2026-04-22T20:24:37.9266667+00:00

Hello Ben Jenkins,

This is actually 3 different settings:

Global Administrator setting → Global Admins become local administrators on Microsoft Entra joined devices

Registering/Joining user setting → if set to All, the user who performs the Microsoft Entra join becomes local administrator on that specific device only

Device Administrators role → separate built-in role that gives local admin access on all Microsoft Entra joined devices

So the empty Device Administrators page is normal. It does not show users who became local admin by joining their own device.

This does not make the user a Global Administrator. It only grants local admin rights on that device, not tenant-wide admin rights.

It also does not appear as a normal Entra role assignment, which is why you won’t see it in role assignments, audit logs, or under Device Administrators.

The best way to verify is directly on the device:

Get-LocalGroupMember -Group "Administrators"

or

net localgroup administrators

Also confirm the device is actually Microsoft Entra joined and not just registered, because this setting applies only to joined devices.

The Device Administrators role is separate and tenant-wide, while the “joining user becomes admin” setting is automatic and device-specific.

Older tenants often had this set to All by default, so many admins are surprised when they first notice it.
Sridevi Machavarapu 33,740 Reputation points Microsoft External Staff Moderator

2026-04-23T20:34:16.6+00:00

Hello Ben Jenkins,

Any update on this? Please confirm if you still have further queries.
Raja Pothuraju 47,730 Reputation points Microsoft Employee Moderator

2026-04-28T09:25:37.4+00:00

@Ben Jenkins, Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.

Answer 1

The “Registering user is added as local administrator on the device during Microsoft Entra join” setting

This setting affects only Microsoft Entra joined Windows devices, not “registered” (workplace joined) devices.
When enabled, the user who performs the join is added to the local Administrators group on that specific device via their Microsoft Entra account.
It does not grant any Microsoft Entra directory role (for example, it does not make the user a Global Administrator or give them tenant‑wide rights). It is purely a local Windows administrator right on the joined device.

The behavior is implemented through the Primary Refresh Token (PRT). Local admin rights are evaluated from the PRT at sign‑in; they are not visible as an Entra ID role assignment.

How to validate whether a joining user is local admin

On a Microsoft Entra joined Windows device:

Sign in as the user in question.
Open an elevated Command Prompt and run:
```
   whoami /groups
```
If the user is a local admin, BUILTIN\Administrators appears in the output.
If the user was just granted local admin via join or via the Entra “local admin” role, and it does not show yet, refresh the PRT and sign‑in state:
```
   dsregcmd /refreshprt
```
Wait 1–2 minutes, sign out, and sign back in, then run whoami /groups again.

This is the same mechanism used when a user is added to the Microsoft Entra Joined Device Local Administrator role; the privilege is delivered via a new PRT and becomes effective after up to 4 hours or after a PRT refresh plus re‑sign‑in.

What the “Device Administrators” / “Microsoft Entra Joined Device Local Administrator” role is

The “Manage Additional local administrators on all Microsoft Entra joined devices” link manages the Microsoft Entra Joined Device Local Administrator role.
Users or groups assigned to this role become local administrators on all Microsoft Entra joined devices in the tenant. This role cannot be scoped to a subset of devices.
This role is separate from the “registering user is local admin” behavior:
- “Registering user is added…” → local admin only on the device they joined.
- “Microsoft Entra Joined Device Local Administrator” role → local admin on every Entra joined device.
Users in this role are not listed directly in the local Administrators group on the device; their admin rights are evaluated from the PRT at sign‑in.

Why the user in the test tenant might not appear as local admin

From the documented behavior of PRT and local admin assignment:

If the user joined the device while already signed in and using a cached PRT, the PRT might not yet contain the claim that grants local admin. In that case, the user will not show as local admin until:
- The PRT is renewed (up to 4 hours automatically), and
- The user signs out and signs back in, or
- dsregcmd /refreshprt is run followed by sign‑out/sign‑in.

If the RMM snapshot was taken before the PRT refresh and re‑sign‑in, it would not show the user as local admin yet.

Direct answers to the numbered questions
The “Registering user is added as local administrator…” option does not make the user a Global Administrator. It only grants local Windows administrator rights on the device that is being Entra joined.
This local admin status is not visible as an Entra ID role assignment. Validation is done on the device itself using whoami /groups after ensuring the PRT has been refreshed (dsregcmd /refreshprt + sign‑out/sign‑in) as described above.
The “Device Administrators” role exposed via “Manage Additional local administrators on all Microsoft Entra joined devices” is the Microsoft Entra Joined Device Local Administrator role. It is a separate, tenant‑wide mechanism to make users local admins on all Entra joined devices and is independent from the “registering user is local admin” setting.

References: