How Is a Help Desk Group Added to Local Administrators on Entra Joined Devices?
You have a Microsoft Entra tenant named contoso.com that contains a group named Contoso Help Desk. You need to ensure that Contoso Help Desk is added to the local Administrators group whenever a Windows device is joined to contoso.com. What should you do?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests which Entra built-in role delivers rights on the endpoint itself; the trap is confusing cloud-side device administration (Cloud Device Administrator) or password management (LAPS) with the role that actually writes the group into the local Administrators group at join time.
To make Contoso Help Desk a local administrator on every Windows device joined to contoso.com, assign the Microsoft Entra Joined Device Local Administrator role to the group. This page confirms why that built-in Entra role — not LAPS, Enterprise State Roaming, or Cloud Device Administrator — satisfies the requirement.
Picking Cloud Device Administrator, because the name sounds like it administers devices; it only manages device objects in the directory (enable, disable, delete, read BitLocker keys) and grants no local privilege on the Windows client.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Contoso Help Desk must appear in the local Administrators group of each Windows device that joins the tenant. That is exactly the behaviour of the Microsoft Entra Joined Device Local Administrator role: when a device completes an Entra join, users (and, via group assignment, members of the group) holding this role are added to the device's local Administrators group. The question asks for a group-level, join-time, per-device outcome, which role assignment delivers without touching each machine manually. As JayHall explained, the role "grants users local administrator rights on devices that are joined to Microsoft Entra ID" and its members are added to the local administrators group on those devices. Assigning it to the Contoso Help Desk group scales to every current and future joined device, so option B is the correct action.Why the Other Options Are Wrong
Option A, Cloud Device Administrator, is a directory-scoped role: it can enable, disable, and delete device objects in Entra ID and read BitLocker recovery keys, but it never elevates a user on the Windows endpoint, so the help desk would not be a local administrator. Option C, Enterprise State Roaming, synchronises user and app settings between Windows devices and has no relationship to local group membership. Option D, Windows LAPS, only manages and rotates the password of a local administrator account on the device — it neither creates the membership the scenario requires nor adds a security group to Administrators. Each distractor addresses a real device-management feature, which is what makes them attractive under exam pressure.Community Comment Notes
Community sentiment on this item is unanimous and confident, with DiligentSam and AleFCI1908 simply marking the role assignment as "correct." JayHall provided the substantive rationale, noting that assigned users gain local administrator rights on Microsoft Entra joined devices and are placed in the local administrators group. Moot2 also confirmed the same role. No commenter argued for LAPS or Cloud Device Administrator, so there is no dissenting reasoning to weigh against the official blueprint behaviour of the role.Official Reference
Exam Strategy
When a question mentions the local Administrators group on Entra joined devices, immediately look for the Microsoft Entra Joined Device Local Administrator role — it is one of the few roles whose effect is on the endpoint, not on the directory object. Read the verbs carefully: 'manage/delete device objects' points to Cloud Device Administrator, while 'become a local administrator on the device' points to this role.
Frequently Asked Questions
Why is Cloud Device Administrator wrong for adding Contoso Help Desk as a local admin?
Cloud Device Administrator only manages device objects in Entra ID (enable, disable, delete, read BitLocker keys). It grants no rights on the Windows client, so members never enter the local Administrators group.
Can Windows LAPS put Contoso Help Desk into the local Administrators group?
No. LAPS backs up and rotates the password of a designated local administrator account; it does not add users or groups to the local Administrators group on joined devices.
Related Analysis
Practice All MD-102 Questions
Access 92 questions with complete answers and detailed explanations.
View Full MD-102 Practice Test →