Do not make the joining user a local administrator at Entra join

Description

The device setting Registering user is added as local administrator on the device during Microsoft Entra join (Preview) is set to None, or to Selected with a small group of device administrators. Regular users who join a device stay standard users on it.

Rationale

A standard user cannot turn off Microsoft Defender, change security policies, read other users' data or install drivers and services. Granting local administrator rights to every person who joins a device turns any phishing payload or malicious download into full control of the endpoint, including credential theft from memory. Least privilege on endpoints is one of the most effective mitigations against ransomware and lateral movement.

Impact

Users can no longer install software that needs elevation on devices they join. Provide software through Intune or the Company Portal, and an elevation process (Endpoint Privilege Management, LAPS-based helpdesk elevation) for exceptions. The setting acts at join time only; devices joined earlier keep the user in the local Administrators group until an Intune local group membership policy replaces it. Windows Autopilot profiles have their own User account type option, which must also be set to Standard.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Devices > Device settings.
3. Check that Registering user is added as local administrator on the device during Microsoft Entra join (Preview) is None, or Selected with a named administrators group.
4. In the Intune admin center, browse to Devices > Device onboarding > Enrollment > Windows > Deployment profiles and check that each Autopilot profile sets User account type to Standard.
5. Alternative, read only: Invoke-MgGraphRequest -Method GET -Uri https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy and read azureADJoin.localAdmins.registeringUsers.
6. Fail if the setting is All (allDeviceRegistrationMembership), or if an Autopilot profile makes users administrators.

Remediation

1. Prepare software distribution through Intune and an elevation process for exceptions.
2. Browse to Entra ID > Devices > Device settings. Role: Cloud Device Administrator.
3. Set Registering user is added as local administrator on the device during Microsoft Entra join (Preview) to None (or Selected with the device administrators group) and save.
4. Graph equivalent: PUT https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy with azureADJoin.localAdmins.registeringUsers set to a noDeviceRegistrationMembership.
5. Set User account type to Standard in every Windows Autopilot deployment profile.
6. For devices already joined, deploy an Intune Account protection > Local user group membership policy that replaces the local Administrators group membership.

Rollback

Set the setting back to All.

References

• How to manage local administrators on Microsoft Entra joined devices Microsoft, vendor-doc, accessed 2026-10-24
• Manage devices in Microsoft Entra ID - Configure device settings Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-DEVICE-005 Do not add Global Administrators as local administrators at Entra join
• related CB-M365-DEVICE-007 Enable Windows LAPS backup to Microsoft Entra ID

People and lifecycle