Do not add Global Administrators as local administrators at Entra join

Description

The device setting Global administrator role is added as local administrator on the device during Microsoft Entra join (Preview) is set to No. Local administration of Entra-joined devices is then delegated through the Microsoft Entra Joined Device Local Administrator role (setting Manage Additional local administrators on all Microsoft Entra joined devices), or through an Intune account protection policy targeting groups of devices.

Rationale

Global Administrators control the whole tenant. Using such an account to sign in to a workstation exposes its credentials and tokens to anything running on that device: malware, a local user with admin rights, or a credential dumping tool. Separating cloud administration from device administration follows the tiering model and means a compromised endpoint does not give access to a Global Administrator session.

Impact

Global Administrators lose implicit local administrator rights on devices joined after the change. Helpdesk and device administrators must receive local rights through the Microsoft Entra Joined Device Local Administrator role or Intune local group policies before the change. The setting applies at join time only: devices joined earlier keep the Global Administrator role SID in their local Administrators group until it is removed by policy (for example an Intune account protection policy that replaces the group membership).

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Devices > Device settings.
3. Check that Global administrator role is added as local administrator on the device during Microsoft Entra join (Preview) is No.
4. Alternative, read only: Invoke-MgGraphRequest -Method GET -Uri https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy and read azureADJoin.localAdmins.enableGlobalAdmins.
5. Fail if the setting is Yes (enableGlobalAdmins is true).

Remediation

1. Make sure device administration is delegated another way: assign the Microsoft Entra Joined Device Local Administrator role (Device settings > Manage Additional local administrators on all Microsoft Entra joined devices), or deploy an Intune Account protection > Local user group membership policy.
2. Browse to Entra ID > Devices > Device settings. Role: Cloud Device Administrator.
3. Set Global administrator role is added as local administrator on the device during Microsoft Entra join (Preview) to No and save.
4. Graph equivalent: PUT https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy with the full policy object and azureADJoin.localAdmins.enableGlobalAdmins set to false.
5. For devices already joined, remove the Global Administrator role SID from the local Administrators group with an Intune local group membership policy (action Replace).

Rollback

Set the setting back to Yes.

References

• How to manage local administrators on Microsoft Entra joined devices Microsoft, vendor-doc, accessed 2026-10-24
• deviceRegistrationPolicy resource type Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-DEVICE-006 Do not make the joining user a local administrator at Entra join
• related CB-M365-DEVICE-007 Enable Windows LAPS backup to Microsoft Entra ID
• related CB-M365-ADMIN-004 Assign least-privileged roles instead of Global Administrator

People and lifecycle