Global Administrator role should not be added as local administrator on the device during Microsoft Entra join

Contributed by Nicola SuterAll contributors →

Part of Maester · Entra ID · Device identity · All checks

Run this check

Invoke-Maester -TestId MT.1090

Overview

The ‘Global Administrator role is added as local administrator on the device during Microsoft Entra join’ setting determines if Microsoft Entra Global Administrator role is added to the local administrators group. This setting applies only once during the actual registration of the device as Microsoft Entra join.

Remediation action

Within the Entra Portal - Device Settings set ‘Global Administrator role is added as local administrator on the device during Microsoft Entra join’ to No. To remediate existing devices, you need to create an Intune account policy, overriding the built-in Windows Administrators group.

Related links

• Intune - Manage local groups on Windows devices
• Microsoft Learn - Device Settings

Details

Every attribute of this check

Field	Value
Test ID	MT.1090
Severity	Medium
Suite	Maester
Product	Entra ID
Feature	Device identity
Area	Privileged access
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1078.004 Cloud Accounts
Supports controls	nist-800-53-r5:AC-6
PowerShell test	Test-MtDeviceRegistrationLocalAdminsGlobalAdmin
Services	Graph

Source

• Test: tests/maester/entra/Test.MT.1090.ps1
• Documentation: tests/maester/entra/Test.MT.1090.md