Also under the Endpoint Security Blade > Account protection in order to give someone admin right on a device we need to currently create a policy Create Group "group name" add a user to it then assign it another group just for the device. This used to be under Microsoft Managed Devices as just a toggle to make the device power user. We also want to make sure Only the Autopilot Assigned user is allowed to logon to the device other than the LAPS account.