CIS.M365.5.1.4.4 - (L1) Ensure local administrator assignment is limited during Entra join
Overview
5.1.4.4 (L1) Ensure local administrator assignment is limited during Entra join
This setting determines if the Microsoft Entra user registering their device as Microsoft Entra join will be added to the local administrators group. This setting applies only once during the actual registration of the device as Microsoft Entra join.
The recommended state is Selected or None.
Rationale
To uphold the principle of least privilege, the assignment of local administrator rights during Microsoft Entra join should be centrally managed using appropriate built-in roles through Intune. This approach minimizes the number of disparate users with elevated privileges, reducing the attack surface and potential for misuse. Centralized management also streamlines the deprovisioning process, ensuring that administrative access can be revoked efficiently and consistently across all devices, rather than requiring manual intervention on each individual endpoint.
Impact
Restricting the default behavior and requiring manual assignment to built-in roles introduces minor administrative overhead. During the Microsoft Entra join process, the Microsoft Entra Joined Device Local Administrator role is automatically added to the device's local administrators group and should be used instead.
Remediation action
- Navigate to Microsoft Entra admin center.
- Expand Entra ID > Devices and select Device settings.
- Set Registering user is added as local administrator on the device during Microsoft Entra join (Preview) to Selected (and add members) or None.
Related links
- Microsoft Entra admin center - Device settings
- How to manage the local administrators group on Microsoft Entra joined devices
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.1.4.4
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.1.4.4 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Device identity |
| Area | Privileged access |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1685 Disable or Modify Tools, T1003 OS Credential Dumping |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.1.4.4 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.1.4.4, nist-800-53-r5:AC-6 |
| PowerShell test | Test-MtCisLocalAdminAssignmentLimited |
| Services | Graph |
Source
- Test:
tests/cis/Test.CIS.M365.5.1.4.4.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.1.4.4.md