{
  "id": "CB-M365-DEVICE-006",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-006",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-006.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-006.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-DEVICE-006",
    "title": "Do not make the joining user a local administrator at Entra join",
    "finding": {
      "title": "Users who join a device become its local administrator",
      "description": "The person who performs Microsoft Entra join is added to the device's local Administrators group and can disable security tools or install software."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "entra-id",
      "device-join",
      "local-admin",
      "least-privilege"
    ],
    "description": "The device setting **Registering user is added as local administrator on the device during\nMicrosoft Entra join (Preview)** is set to **None**, or to **Selected** with a small group of\ndevice administrators. Regular users who join a device stay standard users on it.\n",
    "rationale": "A standard user cannot turn off Microsoft Defender, change security policies, read other users'\ndata or install drivers and services. Granting local administrator rights to every person who\njoins a device turns any phishing payload or malicious download into full control of the\nendpoint, including credential theft from memory. Least privilege on endpoints is one of the\nmost effective mitigations against ransomware and lateral movement.\n",
    "impact": "Users can no longer install software that needs elevation on devices they join. Provide software\nthrough Intune or the Company Portal, and an elevation process (Endpoint Privilege Management,\nLAPS-based helpdesk elevation) for exceptions. The setting acts at join time only; devices joined\nearlier keep the user in the local Administrators group until an Intune local group membership\npolicy replaces it. Windows Autopilot profiles have their own **User account type** option, which\nmust also be set to **Standard**.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Devices > Device settings > Registering user is added as local administrator on the device during Microsoft Entra join (Preview)",
      "default_value": "All",
      "recommended_value": "None (or Selected with a device administrators group)"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Devices** > **Device settings**.\n3. Check that **Registering user is added as local administrator on the device during Microsoft\n   Entra join (Preview)** is **None**, or **Selected** with a named administrators group.\n4. In the Intune admin center, browse to **Devices** > **Device onboarding** > **Enrollment** >\n   **Windows** > **Deployment profiles** and check that each Autopilot profile sets **User\n   account type** to **Standard**.\n5. Alternative, read only: `Invoke-MgGraphRequest -Method GET -Uri\n   https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy` and read\n   `azureADJoin.localAdmins.registeringUsers`.\n6. Fail if the setting is **All** (`allDeviceRegistrationMembership`), or if an Autopilot\n   profile makes users administrators.\n"
    },
    "remediation": {
      "manual": "1. Prepare software distribution through Intune and an elevation process for exceptions.\n2. Browse to **Entra ID** > **Devices** > **Device settings**. Role: Cloud Device\n   Administrator.\n3. Set **Registering user is added as local administrator on the device during Microsoft Entra\n   join (Preview)** to **None** (or **Selected** with the device administrators group) and save.\n4. Graph equivalent: `PUT https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy`\n   with `azureADJoin.localAdmins.registeringUsers` set to a `noDeviceRegistrationMembership`.\n5. Set **User account type** to **Standard** in every Windows Autopilot deployment profile.\n6. For devices already joined, deploy an Intune **Account protection** > **Local user group\n   membership** policy that replaces the local Administrators group membership.\n",
      "rollback": "Set the setting back to **All**.\n"
    },
    "references": [
      {
        "title": "How to manage local administrators on Microsoft Entra joined devices",
        "url": "https://learn.microsoft.com/entra/identity/devices/assign-local-admin",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Manage devices in Microsoft Entra ID - Configure device settings",
        "url": "https://learn.microsoft.com/entra/identity/devices/manage-device-identities",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6(2)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.003"
      },
      {
        "framework": "mitre-attack",
        "id": "T1562.001"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-DEVICE-005",
        "type": "related"
      },
      {
        "id": "CB-M365-DEVICE-007",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}