What this check looks at
Checks whether the Global Administrator role is added to the local administrators of every device joined to Entra ID.
When a Windows device joins Microsoft Entra ID, Entra adds some identities to its local Administrators group. By default this includes the Global Administrator role, so every Global Administrator is a local administrator on every joined device. The setting is Global administrator role is added as local administrator on the device during Microsoft Entra join, under Local administrator settings in the device settings.
The check fails when that setting is Yes and passes when it is No. The setting applies when a device joins: devices already joined keep the Global Administrator role in their local Administrators group until a policy changes it or they are joined again.
Admin rights on every device encourage Global Administrators to sign in to ordinary laptops to fix things, and a Global Administrator signing in to a device that is already compromised exposes their credentials and tokens to whatever is running on it. The most powerful account in the tenant should never be the everyday tool for device support.
Why it matters
When Global Administrators are local administrators everywhere, a Global Administrator signing in to any one compromised laptop exposes the most powerful account in the tenant to whatever runs on it.
A typical scenario: a user’s laptop is infected through a malicious download. The IT manager, a Global Administrator, signs in on the device to investigate because their account works there. Malware harvesting credentials and tokens now holds a Global Administrator session, and an incident on one laptop becomes an incident across the whole tenant.
Separating device administration from tenant administration costs little: Windows LAPS gives each device its own local administrator password, and the Microsoft Entra Joined Device Local Administrator role, ideally through PIM, gives support staff local rights without tenant-wide power.
The CIS Microsoft 365 Foundations Benchmark (5.1.4.3) asks for the Global Administrator role not to be added as local administrator during Entra join, and Cyber Essentials expects administrative rights to be limited to what each person needs. The rule maps to NIST CSF 2.0 PR.AA-05.
How to fix it
Where: Entra admin centre → Devices → Device settings
Before you start
- Make sure there is another way to administer devices: Windows LAPS, or the Microsoft Entra Joined Device Local Administrator role assigned through PIM.
Step by step
- Put another way of administering devices in place. Before removing Global Administrators, make sure support staff can still administer devices: turn on Windows LAPS (see the LAPS finding) and assign the Microsoft Entra Joined Device Local Administrator role to the support team, eligible through PIM where the tenant has Entra ID P2 (Entra ID > Roles & admins > Microsoft Entra Joined Device Local Administrator > Add assignments).
- Change the setting. In the Microsoft Entra admin centre, go to Entra ID > Devices > Device settings. Under Local administrator settings, set Global administrator role is added as local administrator on the device during Microsoft Entra join to No and select Save.
- Plan the clean-up of devices already joined. Existing devices keep Global Administrators as local administrators. To change them, create a policy in the Microsoft Intune admin centre under Endpoint security > Account protection > Create policy > Windows > Local user group membership that sets the Administrators group to the members you want, listing every account you need to keep. Test it on a pilot group of devices before assigning it widely.
- Tell the administrators. Tell Global Administrators that their tenant account will no longer be a local administrator on newly joined devices, and that device support uses LAPS or the device administrator role from a separate account.
- Confirm. Reload Device settings and check the Global Administrator option shows No. Re-run the assessment to confirm the finding passes.
What users will notice
Global Administrators are no longer local administrators on newly joined devices. Devices already joined keep their current administrators until they are re-joined or changed by policy.
How to confirm it worked
Entra admin centre, Devices, Device settings, Local administrator settings: the Global Administrator option is No.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials Plus | Account separation test: admin accounts used only for administration |
| NCSC CAF | B2.c Privileged user management |
| DSPT | Standard 4: Managing data access |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | PA-1 Separate and limit highly privileged/administrative users |
| Zero Trust | Endpoints |
| SOC 2 | CC6.3 Role-based access and least privilege |
| PCI DSS 4.0.1 | 7.2.2 Access is assigned by job function with least privilege |
| NIST SP 800-171 | 3.1.5 Employ the principle of least privilege3.1.6 Use non-privileged accounts for non-security functions |
| CMMC Level 2 | AC.L2-3.1.5 Least PrivilegeAC.L2-3.1.6 Non-Privileged Account Use |
| ISO 27001:2022 | A.8.2 Privileged access rightsA.8.1 User endpoint devices |
| CIS M365 | 5.1.4.3 Ensure the GA role is not added as a local administrator during Entra join |
| CIS Controls v8.1 | 5.4 Restrict administrator privileges to dedicated administrator accounts (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage the local administrators group on joined devices (Microsoft Learn)