# Global Administrator role should not be added as local administrator on the device during Microsoft Entra join

The 'Global Administrator role is added as local administrator on the device during Microsoft Entra join' setting determines if Microsoft Entra Global…

Source: https://maester.dev/docs/tests/MT.1090

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/nicolonsky" title="Nicola Suter · Original author"><img src="https://github.com/nicolonsky.png" alt="Nicola Suter" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/nicolonsky">Nicola Suter</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Device identity · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1090
```

## Overview

The 'Global Administrator role is added as local administrator on the device during Microsoft Entra join' setting determines if Microsoft Entra Global Administrator role is added to the local administrators group. This setting applies only once during the actual registration of the device as Microsoft Entra join.

#### Remediation action

Within the [Entra Portal - Device Settings](https://entra.microsoft.com/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/DeviceSettings/menuId/Overview) set _'Global Administrator role is added as local administrator on the device during Microsoft Entra join'_ to _No_.
To remediate existing devices, you need to create an Intune account policy, overriding the built-in Windows Administrators group.

#### Related links

* [Intune - Manage local groups on Windows devices](https://learn.microsoft.com/intune/intune-service/protect/endpoint-security-account-protection-policy#manage-local-groups-on-windows-devices)
* [Microsoft Learn - Device Settings](https://learn.microsoft.com/entra/identity/devices/manage-device-identities#configure-device-settings)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1090 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Device identity |
| Area | Privileged access |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:AC-6 |
| PowerShell test | [Test-MtDeviceRegistrationLocalAdminsGlobalAdmin](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1090.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/maester/entra/Test.MT.1090.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1090.ps1)
- Documentation: [`tests/maester/entra/Test.MT.1090.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1090.md)