Prevent Auto Local Admin on Entra Join

Add devices to Microsoft Entra ID

Answer Correct answer: D — In Azure AD device settings, turn off "Registering user is added as local administrator on the device during Microsoft Entra join" for contoso.com.

You have an Azure AD tenant named contoso.com. You need to ensure that users are not added automatically to the local Administrators group when they join their Windows 11 device to contoso.com. What should you configure?

Windows Autopilot
provisioning packages for Windows
Security defaults in Azure AD
Device settings in Azure AD Correct Answer

Community Insight

The test is whether you distinguish a tenant-wide Entra join device setting from Intune/Autopilot user-role configuration; the trap is picking Autopilot because it also offers Administrator vs. Standard user types.

This MD-102 question covers Microsoft Entra ID (Azure AD) device settings that control whether the registering user is automatically placed in the local Administrators group on Windows 11 Entra-joined devices. The page confirms that Device settings in Azure AD is the correct place to disable this behavior.

Option A (Windows Autopilot) is the most-chosen wrong answer because Autopilot conversion scripts and 'User device role' settings do let you choose Administrator or Standard — but that applies only to Autopilot-provisioned devices, not to a plain Windows 11 join to contoso.com as the question describes.

Community Discussion (44 comments)

ThomasE 👍 1 Selected: D

D is the correct answer. I initially thought it was A. But thanks to everyone here for pointing out this is NOT referencing AutoPilot, but the Azure AD join process itself.

noa808a 👍 2 Selected: D

A would be the best answer if this were an Intune question. But this question is referencing Entra Join, not Intune Enrollment. Therefore D is the correct answer.

Robert69 👍 1 Selected: D

To prevent the user who performs an Azure AD Join from automatically being added to the local Administrators group on the Windows 11 device, you must configure the device enrollment settings in the Azure AD tenant.Default Behavior: By default, the user who joins a Windows device to Azure AD is granted local administrator rights on that specific device.Required Configuration: The setting that controls this behavior is configured in the Azure AD (now Microsoft Entra ID) portal, under Devices $\rightarrow$ Device settings. This section contains the option that specifies whether the user performing the join operation is automatically granted administrator privileges.

theptr 👍 1 Selected: A

You can config this in autopilot

Aslan 👍 2 Selected: D

Tested in a lab.

sorinaccio 👍 1 Selected: A

If you want to prevent regular users from becoming local administrators, you have the following options: Windows Autopilot & bulk enrollment https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin#manage-regular-users

Knight_Of_Peace 👍 2

You are right but the question is asking about Azure AD join and not Intune enrollment. Thus the correct answer is D. Entra ID > Devices > Devices Settings > Under Local Administration Settings, Change the state to NONE for "Registering user is added as local administrator on the device during Microsoft Entra join (Preview)"

Tr619899 👍 19 Selected: D

To ensure that users are not added automatically to the local Administrators group when they join their Windows 11 device to Azure AD, you should configure Device settings in Azure AD. Specifically, you need to disable the setting that automatically adds users to the local Administrators group on Azure AD-joined devices. This can be done by setting Local Administrator Group Membership to None in Azure AD's device settings. Entra ID > Devices > Devices Settings > Under Local Administration Settings, Change the state to NONE for "Registering user is added as local administrator on the device during Microsoft Entra join (Preview)"

Alboo007_rs007 👍 1 Selected: D

Correct Answer is D ...

Pisces225 👍 1 Selected: A

Only Autopilot prevents the auto join. The people saying D are referencing how to update the local admin after the fact. Using the method referenced in the link has no effect on the automatic addition of the user joining the device, that has to be done in Autopilot.

AleFCI1908 👍 2 Selected: D

D - https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin#manage-the-microsoft-entra-joined-device-local-administrator-role

FemiA55 👍 2

The question is at Entra id join level. Way before Intune & Autopilot. Correct answer is: D

Pisces225 👍 1

Correct. The question asks how to prevent them from ever having been added as a local admin to begin with.

bigreg 👍 1 Selected: D

Identity > Devices > Overview > Device settings

bigreg 👍 2

I changed my mind, I thinks its A now. Windows Autopilot - Windows Autopilot provides you with an option to prevent primary user performing the join from becoming a local administrator by creating an Autopilot profile. I hate how this is worded.

EUC_PRO 👍 2 Selected: D

Confired. It is D - https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin#manage-the-microsoft-entra-joined-device-local-administrator-role

Cezt 👍 4 Selected: D

You can Join the devices i n many ways not just autopilot D

oopspruu 👍 2 Selected: D

Entra Device Settings > Registering user is added as local administrator on the device during Microsoft Entra join (Preview) Technically, A can achieve this too. The question didn't specify if its during OOBE or for Autopilot. So the vagueness makes me incline towards D.

chafe 👍 1 Selected: D

Checked in tenant and ability to restrict local admin privs to some, all or none is present in device settings as preview. Was added ~March '24, the longer you are reading this from now the more likely it is to be right. I still favour D as the question doesn't mention Autopilot, and if you go the autopilot route everyone's device is getting reset.

CJL324 👍 1

D. Device settings in Azure AD. Device settings in Azure AD allow you to configure policies that control device behavior, including settings related to device enrollment and management. You can use these settings to configure restrictions on local administrator access to devices enrolled in Azure AD.

CJL324 👍 1

Option A, Windows Autopilot, primarily focuses on simplifying the deployment and management of Windows devices, including Windows 11 devices, through cloud-based services. While Windows Autopilot offers various configuration options for device provisioning and enrollment, it does not directly control the membership of local groups on devices. Configuring Windows Autopilot might not directly address the requirement to prevent users from being added automatically to the local Administrators group on Windows 11 devices joined to the contoso.com Azure AD tenant. Therefore, while Windows Autopilot can play a role in device provisioning and enrollment, it may not be the most appropriate choice for addressing the specific requirement stated in the scenario.

62b396d 👍 2 Selected: D

Doesn't say anything about autopilot, just that a user joins their device. so D, Device Settings.

62b396d 👍 1

doesnt say anything about autopilot. it says "when user joins". wouldn't that be D? If they never go through autopilot, then Autopilot profile won't do anything.

ejonesy80 👍 2

Right Answer = A Manage regular users: By default, Microsoft Entra ID adds the user performing the Microsoft Entra join to the administrator group on the device. If you want to prevent regular users from becoming local administrators, you have the following options: Windows Autopilot - Windows Autopilot provides you with an option to prevent primary user performing the join from becoming a local administrator by creating an Autopilot profile. Bulk enrollment - a Microsoft Entra join that is performed in the context of a bulk enrollment happens in the context of an autocreated user. Users signing in after a device has been joined aren't added to the administrators group. Source: https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin#manage-regular-users

MJFT 👍 2 Selected: D

https://learn.microsoft.com/en-us/entra/identity/devices/howto-manage-local-admin-passwords Enabling Windows LAPS with Microsoft Entra ID

3661de6 👍 3 Selected: D

D. entra.microsoft.com -> device setting -> Select No under "Registering user is added as local administrator on the device during Microsoft Entra join" The question doesn't mention Autopilot

MR_Eliot 👍 1 Selected: A

A is correct.

Pasado 👍 1

ChatGPT answer is B. Provisioning packages for Windows.

VLAG 👍 1

ChatGPT is useful but it gives wrong answers when it is used in a wrong way. Here's "A"

mp34 👍 1

There is a setting in Autopilot deployment profile to set either a Standard or Administrator user.....but the question doesnt mention adding devices to Intune...so why Autopilot?

Mattia8 👍 1 Selected: A

Correct

Amir1909 👍 1

Correct

belyo 👍 4 Selected: A

yosry 👍 1 Selected: A

correct

GavrilG 👍 1

The correct answer is D. Device settings in Azure AD. To prevent users from being added automatically to the local Administrators group when they join their Windows 11 device to contoso.com, you need to configure the Device settings in Azure AD.

cpaljchc4 👍 1

Manage regular users By default, Microsoft Entra ID adds the user performing the Microsoft Entra join to the administrator group on the device. If you want to prevent regular users from becoming local administrators, you have the following options: Windows Autopilot - Windows Autopilot provides you with an option to prevent primary user performing the join from becoming a local administrator by creating an Autopilot profile. Bulk enrollment - a Microsoft Entra join that is performed in the context of a bulk enrollment happens in the context of an autocreated user. Users signing in after a device has been joined aren't added to the administrators group. REF:https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin#manage-the-azure-ad-joined-device-local-administrator-role Found this, I'm going with A.

LiamAzure 👍 1

"When they join their device" Does this mean Autopilot is not being used, since they are manually adding their device. Or am I reading too much into it Its A or D depending on what microsoft is looking for

yoha1558 👍 13 Selected: A

in Autopilot, you choose the type of user Administrator or Standard.

BJS78 👍 2

As the task says: "...are not added automatically..." "D" cannot be good as "When you remove users from the Azure AD Joined Device Local Administrator role, changes aren't instant. Users still have local administrator privilege on a device as long as they're signed in to it. The privilege is revoked during their next sign-in when a new primary refresh token is issued. This revocation, similar to the privilege elevation, could take up to 4 hours.", so only Autopilot will block user to be added by default

h38jhd38k 👍 2

Direct link for Windows Autopilot https://learn.microsoft.com/en-us/azure/active-directory/devices/assign-local-admin#manage-regular-users

Zelda78 👍 2

I would say A, as explained here: https://learn.microsoft.com/en-us/azure/active-directory/devices/assign-local-admin By default, Microsoft Entra ID adds the user performing the Microsoft Entra join to the administrator group on the device. If you want to prevent regular users from becoming local administrators, you have the following options: Windows Autopilot - Windows Autopilot provides you with an option to prevent primary user performing the join from becoming a local administrator by creating an Autopilot profile. Greetings, arjan versloot

Contactfornitish 👍 1 Selected: D

As per the article, default is the user joining the machine would be local admin and if you want to remove that then you would need to move to manage local admin membership, which is something that can be done via device settings only, not default auto-pilot or security defaults etc https://docs.microsoft.com/en-us/azure/active-directory/devices/assign-local-admin

cpaljchc4 👍 1

Restrict users from recovering the BitLocker key(s) for their owned devices Yes No I only found this under Device Settings on Entra ID=(

VirtualJP 👍 2 Selected: A

Having to go with this answer as the closest best match. https://learn.microsoft.com/en-us/azure/active-directory/devices/assign-local-admin

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Device settings in Azure AD (now Microsoft Entra ID > Devices > Device settings) contains the toggle "Registering user is added as local administrator on the device during Microsoft Entra join"; setting it to No stops the joining user from landing in the local Administrators group. This is a tenant-wide directory setting that applies to every Entra join, exactly matching the scenario where users join a Windows 11 device directly to contoso.com. As AleFCI1908 linked, Microsoft's official local-admin management article documents this control under the Entra-joined device local administrator role, and Aslan confirmed the behavior in a lab.

Why the Other Options Are Wrong

Windows Autopilot (A) does expose an Administrator vs. Standard user choice, but it governs only devices registered for Autopilot self-deployment or pre-provisioning, not a user-initiated Entra join. Provisioning packages (B) configure settings during Windows setup and can stage configuration, but they are not the mechanism that governs tenant-level join-time group membership. Security defaults (C) enforce baseline MFA and legacy authentication blocking and have no bearing on local group membership. Several commenters, including Knight_Of_Peace and FemiA55, stressed that the question targets Entra join rather than Intune enrollment, which rules out profile- or enrollment-based answers.

Community Comment Notes

The discussion converged strongly on D: Tr619899 explained you disable the setting that "automatically adds users to the local Administrators group on Azure AD-joined devices," and 3661de6 pointed to selecting No for "Registering user is added as local administrator on the device during Microsoft Entra join." The dissenting votes for A came from commenters who focused on Autopilot's Administrator/Standard choice, but noa808a rebutted that by noting "A would be the best answer if this were an Intune question" while this one references Entra join. Cezt added that "You can Join the devices in many ways not just autopilot," reinforcing that the answer must be tenant-level.

Official Reference

https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin

Exam Strategy

Read whether the scenario says 'join to the tenant' versus 'provisioned through Intune/Autopilot' — tenant-level join behavior is configured in Entra ID device settings, while Autopilot answers apply only to registered, profile-driven deployments.

Frequently Asked Questions

Why isn't Windows Autopilot the answer for blocking local admin on join?

Autopilot's Administrator/Standard user role applies only to Autopilot-provisioned devices, not to a plain Windows 11 Entra join to the tenant.

Where exactly do I disable automatic local admin during Entra join?

In Microsoft Entra ID (Azure AD), go to Devices > Device settings and set "Registering user is added as local administrator on the device during Microsoft Entra join" to No.

More MD-102 FAQ →

Related Analysis

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide