Deploying a Local Admin Account to Multiple Targets

there are two primary methods I've found to make this kind of situation work, depending on your domain situation.

1. Domain Hybrid Joined -> LAPS
   1. Create policy under Account Protection using profile "Local admin password solution (Windows LAPS)" with desired configuration settings.
   2. Create a device configuration policy (separate from LAPS above) with Settings Catalog.
      1. Add settings:
         1. "Accounts Enable Administrator Account Status" set to Enable.
         2. "Accounts Rename Administrator Account" set to desired name (whatever you set in LAPS Policy).
   3. Deploy both policies to desired group of devices.
2. Entra Joined
   1. Create an EntraID security group for administrative users.
   2. Add the Azure role "Microsoft Entra Joined Device Local Administrator" to the group you created.