Add User to Remote Desktop Users Group in Intune

MD-102 By islever Editorial Last updated

Plan and implement device configuration profiles

Short answer

D Configure a device configuration profile to add the user to the Remote Desktop Users group on each marketing department device.

Question

You have a Microsoft 365 subscription that contains a user named User1 and uses Microsoft Intune Suite.
You use Microsoft Intune to manage devices that run Windows 11.
User provides remote support for 75 devices in the marketing department.
You need to add User1 to the Remote Desktop Users group on each marketing department device.
What should you configure?
  1. an app configuration policy
  2. a device compliance policy
  3. an account protection policy
  4. a device configuration profile Correct Answer

Key Takeaways

The question tests your knowledge of local group management in Intune, where device configuration profiles are the standard GA mechanism for managing local user and group memberships.

To add a user to the Remote Desktop Users group on Windows 11 devices via Microsoft Intune, you must configure a device configuration profile. This page explains why this is the correct method compared to other policy types.

Common mistake: Many candidates incorrectly choose 'Account Protection Policy' because it can manage local groups, but this feature is often in preview or limited in scope, whereas Device Configuration Profiles are the general solution.

Expert Analysis

Why the Answer Is Correct

A Device Configuration Profile (Option D) is the appropriate tool for adding a user to a local group like Remote Desktop Users. You can achieve this by creating a Custom OMA-URI profile or using the Settings Catalog with the Local Group membership setting. This is a fully supported, General Availability (GA) feature in Intune.

Why the Other Options Are Wrong

App Configuration Policies (A) apply settings to specific apps, not system-level groups. Device Compliance Policies (B) enforce security standards (like encryption or PINs) rather than configuring local user memberships. Account Protection Policies (C) were historically focused on password policies and Windows Hello; while newer versions allow local group management, they may be in preview or less universally applicable for this specific task compared to the robust Device Configuration Profile option in exam contexts.

Community Comment Notes

Several community members, such as Besxp and 02dc19c, emphasized that while Account Protection might technically work in some previews, Device Configuration Profile is the "fully supported" and expected answer for exams. Others like Robert69 correctly ruled out App and Compliance policies for their distinct purposes. The consensus highlights that Device Configuration Profiles are the reliable method for managing local group memberships across Windows devices.

Official Reference

https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-account-protection-policy#manage-local-groups-on-windows-devices

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked to manage local users or groups on Windows devices, prioritize Device Configuration Profiles unless the question specifically points to a new, named feature like 'Endpoint Security' policies that explicitly state they handle local groups in a GA capacity. Always check if the feature mentioned is in Preview vs. GA.

Frequently Asked Questions

Why not use an Account Protection Policy?

Account Protection Policies are primarily for password and Windows Hello settings. While some updates allow local group management, Device Configuration Profiles are the established, GA method for this task.

Can I use GPOs instead of Intune profiles?

No, Intune manages devices via cloud policies. You would use a Device Configuration Profile with OMA-URI to replicate GPO-like local group settings within Intune.

More MD-102 FAQ →

Discussion 37 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 37

  1. Fortind1974 👍 19 Answered C
    C. an account protection policy https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-account-protection-policy#manage-local-groups-on-windows-devices
  2. picho707 👍 4
    The correct answer is D. This is a device configuration profile. Here's how you can do it: In the Microsoft Intune portal, go to "Devices" and select "Configuration profiles." Click on "Create profile" to create a new device configuration profile. Choose the platform for the devices you want to target (Windows 11 in this case). In the configuration settings, look for the option to configure local user groups or local administrators on Windows 11 devices. Add User1 as a member of the "Remote Desktop Users" group. Assign this configuration profile to the devices in the marketing department.
  3. 02dc19c 👍 4 Answered D
    To add User1 to the Remote Desktop Users group on the Windows 11 devices, you would use a device configuration profile in Microsoft Intune. Specifically, you can configure a Group Policy Object (GPO) or use a custom configuration profile to add User1 to the Remote Desktop Users group across multiple devices. This approach ensures the policy is applied to all relevant devices in the marketing department.
  4. Robert69 👍 3 Answered D
    A. An app configuration policy: This is used to configure settings inside mobile apps (like Outlook or Teams) on iOS/Android devices. It has no capability to manage Windows local system groups. B. A device compliance policy: This defines security standards (e.g., must have a PIN, firewall enabled) a device must meet to be considered "compliant." It is used for reporting and conditional access, not for applying configuration settings like adding a user to a local group. C. An account protection policy: This policy is part of Endpoint Security and focuses on protecting user credentials and accounts, primarily by managing settings like Windows Hello for Business, Credential Guard, and Local Security Authority (LSA) protection. It is not the standard or correct tool for managing local user group membership.
  5. _Dinkan_ 👍 3 Answered C
    C. an account protection policy Tested in LAB. Intune Admin Center > Endpoint Security > Account Protection > Create Policy > Platform: Windows, Profile: Local user group Membership Reference: https://learn.microsoft.com/en-us/intune/intune-service/protect/endpoint-security-account-protection-policy#manage-local-groups-on-windows-devices
Show 25 more comments
  1. Tr619899 👍 3 Answered D
    A Device Configuration Profile provides a way to manage device settings, including adding users or groups to local device groups like Remote Desktop Users.
  2. ronnykings 👍 3
    Accorrding to Bing Chat the correct answer is D: a a device configuration profile
  3. ergacharsk 👍 2 Answered D
    A device configuration profile in Microsoft Intune allows you to manage various settings on Windows 11 devices, including user permissions. By creating a device configuration profile, you can specify settings to automatically add User1 to the Remote Desktop Users group on all targeted devices. Steps to Configure a Device Configuration Profile: Sign in to the Microsoft Intune admin center. Select Devices > Configuration profiles > Create profile. Platform: Choose Windows 10 and later. Profile type: Select Custom. *Configuration settings: Use OMA-URI settings to configure the membership of the Remote Desktop Users group.
  4. Besxp 👍 2 Answered D
    ✅ Correct exam answer: D. Device Configuration Profile It's the fully supported, general availability (GA) method to add a user to the Remote Desktop Users group. C (Account Protection Policy) can also work, but it's still in preview, and Microsoft exams typically avoid preview features. Use a Device Configuration Profile with the Settings Catalog or Custom OMA-URI to configure local group membership. https://learn.microsoft.com/en-us/mem/intune/configuration/local-users-groups-settings-windows
  5. Prasis 👍 2
    D To add User1 to the Remote Desktop Users group on each marketing department device, you should configure a device configuration profile. Device configuration profiles in Microsoft Intune allow you to define and push settings to managed devices. In this case, you can use a device configuration profile to manage the built-in group memberships on devices, including the Remote Desktop Users group. This will allow User1 to provide remote support for the devices in the marketing department.
  6. Krayzr 👍 2
    You are correct Sir Local user group membership (preview) – Use this profile to add, remove, or replace members of the built-in local groups on Windows devices. For example, the Administrators local group has broad rights. You can use this policy to edit the Admin group's membership to lock it down to a set of exclusively defined members.
  7. 02dc19c 👍 2 Answered D
    account protection policy isn't the correct choice in this scenario. Account protection policies in Intune are generally used to configure security-related settings, such as enforcing password policies or managing Windows Hello for Business.
  8. Krayzr 👍 2 Answered C
    C is correct Still in preview, but Tried in my tenant https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-account-protection-policy#manage-local-groups-on-windows-devices
  9. yoha1558 👍 2
    verify with the url https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-account-protection-policy#manage-local-groups-on-windows-devices you check it's C
  10. henil_154762 👍 2 Answered D
    Ans - D checked on Microsoft
  11. Le_Patriarche2025 👍 1 Answered D
    La bonne réponse est D. Un profil de configuration de l'appareil. Raisonnement : Dans Intune, pour ajouter un utilisateur au groupe "Utilisateurs du Bureau à distance" (Remote Desktop Users) sur les appareils locaux, on utilise un profil de configuration d'appareil avec le type "Groupes d'utilisateurs et d'appareils locaux" (Local users and groups). Ce profil permet de : Cibler un groupe local spécifique (ex. Remote Desktop Users) Y ajouter un utilisateur Azure AD (User1) Déployer cela automatiquement sur les 75 appareils du département marketing
  12. Merrybob 👍 1 Answered C
    C. an account protection policy Ref: https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin#manage-administrator-privileges-using-microsoft-entra-groups-preview:~:text=Organizations%20can%20use%20Intune%20to%20manage%20these%20policies%20using%20Custom%20OMA%2DURI%20Settings%20or%20Account%20protection%20policy.
  13. Frank_2022 👍 1 Answered D
    Device configuration profiles are used to configure settings on managed devices.In this case, you need to modify a specific setting (adding a user to a group) on multiple devices.This allows you to define this setting and push it out to the targeted devices (in this case, the marketing department's Windows 11 devices).
  14. Besxp 👍 1
    Sorry, the link didn't work, but did some deeper research: Both D (Device Configuration Profile) and C (Account Protection policy) work technically. But for exam clarity and production best practices, D is the recommended answer. You can confidently base this on Microsoft documentation.
  15. CJL324 👍 1
    D. A device configuration profile in Intune allows you to manage settings and configurations on the devices, including adding users to specific local groups such as the Remote Desktop Users group. You can create a custom profile to automate this task across all the relevant devices.
  16. ThomasE 👍 1 Answered C
    The reason this is so confusing is after you create the Account Protection Policy, it also appears in the Device Configuration Policy section. You can even EDIT existing account protection policies, but you cannot create a new one there! Interesting.....and confusing.
  17. NoursBear 👍 1
    It can be done with a configuration profile setting but there are more steps: https://www.petervanderwoude.nl/post/enabling-remote-access-for-specific-users-on-azure-ad-joined-devices/ Account protection under Endpoint Security seems to correct one though
  18. Darkfire 👍 1 Answered C
    Should be C idd. https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-account-protection-policy#:~:text=Local%20user%20group%20membership%20(preview)%20%E2%80%93%20Use,Manage%20local%20groups%20on%20Windows%20devices.
  19. HueCumber 👍 1 Answered C
    Intune admin center → Endpoint security → Account protection → Create policy → Profile: Local user group membership → Local group: Remote Desktop Users → Add User1 (or an AAD group containing User1) → Assign to Marketing devices
  20. BJS78 👍 1
    a) you need to select "Settings catalog" or "Templates" after the platform b) no, there is no such. You can manage local groups only via "Endpoint Security \ Account protection"
  21. oopspruu 👍 1 Answered C
    Account Protection section in Endpoint Security has the policy for exactly this purpose. We use this to create users in local Admin groups when making LAPS policies.
  22. scrapper_slapper 👍 1 Answered D
    i think its D . you are not configuring the account you are adding an account to a local group (of the device) which you can do with Device Configuration Profile
  23. EUC_PRO 👍 1 Answered C
    https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-account-protection-policy#manage-local-groups-on-windows-devices
  24. mp34 👍 1
    I thought if a topic was in preview then it would not be on the exam....the link provided by Fortind1974 says it is still in preview...
  25. Menovice 👍 1
    C is correct. Enabling Remote Desktop: Creating Configuration Profile Adding Users to Remote Desktop: Account Protection

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Assigning Intune and Cloud PC Roles with Least Privilege

S-grade

SCEP Root Certificate Location for Intune

S-grade

How Many Intune Profiles Are Needed for Cloud PKI User Certificates?

S-grade

What Must Be Purchased First for Intune Device Query at Minimum Cost?

S-grade

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide