Event banner
Event details
We changed the new Entra setting "Registering user is added as local administrator on the device during Microsoft Entra join (Preview)" to None expecting this would make the only way for the registering user to become an admin be from an Autopilot profile that sets the User Account Type to Administrator. Instead, all devices completing Autopilot had no accounts as administrators regardless of the setting in the Autopilot profile. Is this the expected behavior? If someone does a manual Entra join, we don't want them to be admin, but we have one scenario where we need the user to be admin and have the Autopilot profile set that way.
If you want to have a local admin account, you can create a new local admin account using OMA-URI and use LAPS.
- Jason_Sandys
Microsoft
To my knowledge, yes this is expected behavior. For your scenario, you should block personal enrollment to Intune and use CA to block access to corporate resources from an unmanaged device.- Jon_AndesThe most secure setting wins, so Entra policy setting to None wins out in this case.
