Microsoft Entra Device Administrator role not applying to local Administrators group

Question

Hi everyone,

I'm hoping someone has run into this before because I'm at a loss.

I'm setting up a new Windows 11 Pro laptop for an employee in our Microsoft 365 environment. During the Windows OOBE setup, we signed in directly with the user's Microsoft Entra ID account, so the device is Microsoft Entra joined from the start.

The issue is that the Microsoft Entra Device Administrator role is not being applied to the local Administrators group on the device.

Environment

• Microsoft 365 Business Standard
• Microsoft Entra ID
• Windows 11 Pro
• Microsoft Entra joined (not hybrid)
• No on-premises Active Directory
• No Intune policies configured

What I've verified

• The device successfully joined Microsoft Entra during setup.
• dsregcmd /status reports:
  • AzureAdJoined = YES
    • DeviceAuthStatus = SUCCESS
    • whoami /upn returns the correct Entra user.
    • The device appears correctly in Microsoft Entra Devices.
    • The device owner is correct.
    • The user signs into Windows using their Microsoft Entra credentials.
    • Event Viewer (Applications and Services Logs → Microsoft → Windows → User Device Registration → Admin) contains no errors related to the join.
    • gpupdate /force completes successfully.

Device Administrator configuration

I assigned both:

• Blenda Carter (Global Administrator)
• Davion Jones

to the Microsoft Entra Device Administrator role.

I verified the assignments both:

• Under Roles & Administrators → Device Administrators
• On the individual device under Roles and administrators

The assignments show as Active, not Eligible.

The problem

Even after:

• Waiting for replication
• Multiple full restarts
• Running gpupdate /force

the command:

still only returns the built-in Administrator account.

Neither of the assigned Microsoft Entra Device Administrators are ever added to the local Administrators group.

Additionally, Windows still displays:

"Sign in as an administrator to change device management settings."

when viewing Settings → Accounts → Access work or school.

My question

Has anyone experienced Microsoft Entra Device Administrator assignments simply not applying to a Windows 11 Pro device?

Is there a known issue with the legacy Device Administrator role, Microsoft 365 Business Standard licensing, or Windows 11 version 24H2 that would prevent the local Administrators group from being updated?

At this point, I'm trying to determine whether this is:

• a replication issue,
• a licensing limitation,
• a Windows bug,
• or whether I should disconnect and rejoin the device to Microsoft Entra.

Any insight or suggestions would be greatly appreciated.

Thank you!Hi everyone,

I'm hoping someone has run into this before because I'm at a loss.

I'm setting up a new Windows 11 Pro laptop for an employee in our Microsoft 365 environment. During the Windows OOBE setup, we signed in directly with the user's Microsoft Entra ID account, so the device is Microsoft Entra joined from the start.

The issue is that the Microsoft Entra Device Administrator role is not being applied to the local Administrators group on the device.

Environment

• Microsoft 365 Business Standard
• Microsoft Entra ID
• Windows 11 Pro
• Microsoft Entra joined (not hybrid)
• No on-premises Active Directory
• No Intune policies configured

What I've verified

• The device successfully joined Microsoft Entra during setup.
• dsregcmd /status reports:
  • AzureAdJoined = YES
    • DeviceAuthStatus = SUCCESS
    • whoami /upn returns the correct Entra user.
    • The device appears correctly in Microsoft Entra Devices.
    • The device owner is correct.
    • The user signs into Windows using their Microsoft Entra credentials.
    • Event Viewer (Applications and Services Logs → Microsoft → Windows → User Device Registration → Admin) contains no errors related to the join.
    • gpupdate /force completes successfully.

Device Administrator configuration

I assigned both:

• Blenda Carter (Global Administrator)
• Davion Jones

to the Microsoft Entra Device Administrator role.

I verified the assignments both:

• Under Roles & Administrators → Device Administrators
• On the individual device under Roles and administrators

The assignments show as Active, not Eligible.

The problem

Even after:

• Waiting for replication
• Multiple full restarts
• Running gpupdate /force

the command:

still only returns the built-in Administrator account.

Neither of the assigned Microsoft Entra Device Administrators are ever added to the local Administrators group.

Additionally, Windows still displays:

"Sign in as an administrator to change device management settings."

when viewing Settings → Accounts → Access work or school.

My question

Has anyone experienced Microsoft Entra Device Administrator assignments simply not applying to a Windows 11 Pro device?

Is there a known issue with the legacy Device Administrator role, Microsoft 365 Business Standard licensing, or Windows 11 version 24H2 that would prevent the local Administrators group from being updated?

At this point, I'm trying to determine whether this is:

• a replication issue,
• a licensing limitation,
• a Windows bug,
• or whether I should disconnect and rejoin the device to Microsoft Entra.

Any insight or suggestions would be greatly appreciated.

Thank you!

Answer 1

The behavior is explained by how Microsoft Entra local admin rights are actually granted on Entra‑joined devices and by the distinction between directory roles and local group membership.

Key points from the documented behavior:

1. Device Administrator / Entra Joined Device Local Administrator is not shown as a local group member
   Users assigned to the Microsoft Entra Joined Device Local Administrator role (or via Manage Additional local administrators on Microsoft Entra joined devices) are not directly listed in the local Administrators group. Their admin rights are evaluated at sign‑in from the Primary Refresh Token (PRT):
   • "Users aren't directly listed in the local administrator group, their permissions are received through the Primary Refresh Token."
     Therefore, commands that enumerate local group membership (for example, net localgroup administrators) will typically show only the built‑in Administrator and any manually added accounts, not the Entra Device Administrators.
2. How to verify that Entra admin rights are applied
   To confirm that the user actually has local admin rights, use whoami rather than checking the local group list:
   • Sign in as the Entra user.
   • Run:

          whoami /all
     

   • In the output, check the GROUP INFORMATION section for BUILTIN\Administrators in the Group Name column. If present, the user has local administrator rights on that device, even if they are not explicitly listed in the local Administrators group.
3. PRT refresh and timing requirements
   Local admin rights via Entra roles are tied to the PRT. Changes to the Device Administrator / Entra Joined Device Local Administrator role do not take effect immediately on devices where the user is already signed in:
   • Elevation occurs only after:
     1. Up to 4 hours have passed so Entra issues a new PRT with the updated privileges.
     2. The user signs out and signs back in (lock/unlock is not sufficient).
   • If the role was activated via PIM or assigned while the user had a cached PRT, the user may need to refresh the PRT explicitly:
     1. Run:

                dsregcmd /refreshprt
        

     2. Wait 1–2 minutes.
     3. Sign out and sign back in.
     4. Run:

                whoami /groups
        

        and verify that BUILTIN\Administrators appears.
4. Tenant‑wide scope of the Entra Joined Device Local Administrator role
   The Entra Joined Device Local Administrator role (managed via Device settings → Manage Additional local administrators on all Microsoft Entra joined devices) applies tenant‑wide:
   • "Microsoft Entra Joined Device Local Administrators are assigned to all Microsoft Entra joined devices. You can't scope this role to a specific set of devices."
     If the users are correctly assigned to this role, they should receive local admin rights on all Entra‑joined devices in the tenant, subject to the PRT refresh behavior above.
5. Licensing and Windows version
   The ability to manage Additional local administrators on all Microsoft Entra joined devices requires Microsoft Entra ID P1 or P2 licenses. The documentation does not list a Windows 11 24H2‑specific limitation; the key requirement is the Entra license and the PRT behavior.
   If the tenant does not have P1/P2, the Device Administrator mechanism via that setting will not be available.
6. If immediate local admin membership is required
   For a specific device, a user can be manually elevated into the local Administrators group:
   • On Windows 10 1709 and later (including Windows 11):
     • Go to Settings → Accounts → Other users.
     • Select Add a work or school user, enter the user’s UPN, and set Account type to Administrator.
   • Or via command prompt for Entra‑only users:

          net localgroup administrators /add "AzureAD\<UserUPN>"
     

   This bypasses the PRT‑based role evaluation and will show the user explicitly in the local Administrators group.

In summary, the observed behavior (no visible Entra Device Administrators in the local Administrators group and the Access work or school message) is consistent with documented Entra join behavior: admin rights from the Device Administrator / Entra Joined Device Local Administrator role are delivered via the PRT and verified with whoami, not by direct local group membership. Ensuring a fresh PRT (wait up to four hours or run dsregcmd /refreshprt and fully sign out/in) and verifying with whoami /all is the recommended way to confirm that the role is applied. If explicit local group membership is required on that device, use manual elevation.

---

References:

• How to manage the local administrators group on Microsoft Entra joined devices
• No local administrator group privileges on Microsoft Entra joined device
• Manage device identities using the Microsoft Entra admin center