What this check looks at
Checks whether everyone who joins a device to Entra ID becomes a local administrator on it, or only selected people.
By default, whoever joins a Windows device to Microsoft Entra ID becomes a local administrator on it. The setting Registering user is added as local administrator on the device during Microsoft Entra join can be All (the default), Selected or None. Windows Autopilot deployment profiles have their own User account type setting, which can make the person a standard user whatever this setting says.
The check passes when the setting is Selected or None and fails when everyone who joins a device becomes its local administrator.
A local administrator can install any software, turn off or add exclusions to security tools, change firewall rules and read other people’s data on the machine. Malware that runs as that person inherits all of it. When every user is an administrator of their own laptop, one malicious download or convincing fake installer is enough to disable protection on the device.
Why it matters
Local administrator rights let malware and unwanted software install themselves and switch off protections. Giving them to every person who joins a device removes that barrier across the fleet.
Ransomware and information stealers depend on admin rights to switch off Defender, install persistence and dump credentials. In a typical small-business incident, a user installs a free "PDF converter" that is really malware; running as a local administrator, it adds an antivirus exclusion and works undisturbed. As a standard user, the same installer would have stopped at a prompt for credentials the user does not have.
Removing admin rights also cuts support costs: fewer unapproved tools, fewer broken configurations and a consistent estate. It does need a way for people to get the software they need, usually the Company Portal app with the client’s common apps published in Intune, which is why this change needs telling and supporting rather than a single click.
Cyber Essentials requires administrative accounts to be used only for administration and user accounts to hold only the privileges they need, and the CIS Microsoft 365 Foundations Benchmark (5.1.4.4) asks for local administrator assignment at join to be limited. The rule maps to NIST CSF 2.0 PR.AA-05.
How to fix it
Where: Entra admin centre → Devices → Device settings
Before you start
- Check whether staff install their own software today; if so, plan Company Portal or Autopilot standard-user deployment before the change.
- Tell users what is changing and when, with a contact for problems.
Step by step
- Find out how people get software today. Ask the client which applications staff install themselves. Publish the common ones in the Microsoft Intune admin centre (Apps > Windows > Add) as available in Company Portal, so people have a route that does not need admin rights.
- Decide who keeps local admin rights. Usually nobody outside IT. If a few people genuinely need them, such as developers, create a group for them in Entra ID > Groups, or give them the Microsoft Entra Joined Device Local Administrator role through PIM instead.
- Change the Entra setting. In the Microsoft Entra admin centre, go to Entra ID > Devices > Device settings. Under Local administrator settings, set Registering user is added as local administrator on the device during Microsoft Entra join to None (or Selected, with the group from the previous step) and select Save.
- Set Autopilot profiles to standard users. If Windows Autopilot is used, in the Microsoft Intune admin centre open each Windows Autopilot deployment profile (Devices > Windows, then the Windows Autopilot deployment profiles), edit the Out-of-box experience (OOBE) settings and set User account type to Standard.
- Plan for devices already joined. The change applies to devices joined from now on. People who are already local administrators of their current laptop stay so until it is rebuilt, or until an Intune Local user group membership policy (Endpoint security > Account protection) sets who is in the Administrators group. Agree that follow-up with the client.
- Tell staff. Tell staff that new and rebuilt laptops will not let them install software themselves, and that Company Portal or the service desk is how to get it.
- Confirm. Reload Device settings and check the registering user option shows None or Selected. On a newly joined device, run net localgroup Administrators in an elevated prompt: the person’s account should not be listed. Re-run the assessment to confirm.
What users will notice
People who join a device from now on are standard users on it. They install software from Company Portal or ask IT.
How to confirm it worked
Entra admin centre, Devices, Device settings, Local administrator settings: the registering user option is Selected or None.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials Plus | Account separation test: admin accounts used only for administration |
| NCSC CAF | B2.c Privileged user management |
| DSPT | Standard 4: Managing data access |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | PA-7 Follow just enough administration (least privilege) |
| Zero Trust | Endpoints |
| SOC 2 | CC6.3 Role-based access and least privilege |
| PCI DSS 4.0.1 | 7.2.2 Access is assigned by job function with least privilege |
| NIST SP 800-171 | 3.1.5 Employ the principle of least privilege |
| CMMC Level 2 | AC.L2-3.1.5 Least Privilege |
| ISO 27001:2022 | A.8.2 Privileged access rightsA.8.1 User endpoint devices |
| CIS M365 | 5.1.4.4 Ensure local administrator assignment is limited during Entra join |
| CIS Controls v8.1 | 5.4 Restrict administrator privileges to dedicated administrator accounts (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage the local administrators group on joined devices (Microsoft Learn)