How Is a Help Desk Group Added to Local Administrators on Entra Joined Devices?
Short answer
B Assign the Microsoft Entra Joined Device Local Administrator role so Contoso Help Desk is added to the local Administrators group on every Entra joined device.
Question
Key Takeaways
The exam tests which Entra built-in role delivers rights on the endpoint itself; the trap is confusing cloud-side device administration (Cloud Device Administrator) or password management (LAPS) with the role that actually writes the group into the local Administrators group at join time.
To make Contoso Help Desk a local administrator on every Windows device joined to contoso.com, assign the Microsoft Entra Joined Device Local Administrator role to the group. This page confirms why that built-in Entra role — not LAPS, Enterprise State Roaming, or Cloud Device Administrator — satisfies the requirement.
Common mistake: Picking Cloud Device Administrator, because the name sounds like it administers devices; it only manages device objects in the directory (enable, disable, delete, read BitLocker keys) and grants no local privilege on the Windows client.
Expert Analysis
Why the Answer Is Correct
Contoso Help Desk must appear in the local Administrators group of each Windows device that joins the tenant. That is exactly the behaviour of the Microsoft Entra Joined Device Local Administrator role: when a device completes an Entra join, users (and, via group assignment, members of the group) holding this role are added to the device's local Administrators group. The question asks for a group-level, join-time, per-device outcome, which role assignment delivers without touching each machine manually. As JayHall explained, the role "grants users local administrator rights on devices that are joined to Microsoft Entra ID" and its members are added to the local administrators group on those devices. Assigning it to the Contoso Help Desk group scales to every current and future joined device, so option B is the correct action.
Why the Other Options Are Wrong
Option A, Cloud Device Administrator, is a directory-scoped role: it can enable, disable, and delete device objects in Entra ID and read BitLocker recovery keys, but it never elevates a user on the Windows endpoint, so the help desk would not be a local administrator. Option C, Enterprise State Roaming, synchronises user and app settings between Windows devices and has no relationship to local group membership. Option D, Windows LAPS, only manages and rotates the password of a local administrator account on the device — it neither creates the membership the scenario requires nor adds a security group to Administrators. Each distractor addresses a real device-management feature, which is what makes them attractive under exam pressure.
Community Comment Notes
Community sentiment on this item is unanimous and confident, with DiligentSam and AleFCI1908 simply marking the role assignment as "correct." JayHall provided the substantive rationale, noting that assigned users gain local administrator rights on Microsoft Entra joined devices and are placed in the local administrators group. Moot2 also confirmed the same role. No commenter argued for LAPS or Cloud Device Administrator, so there is no dissenting reasoning to weigh against the official blueprint behaviour of the role.
Official Reference
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a question mentions the local Administrators group on Entra joined devices, immediately look for the Microsoft Entra Joined Device Local Administrator role — it is one of the few roles whose effect is on the endpoint, not on the directory object. Read the verbs carefully: 'manage/delete device objects' points to Cloud Device Administrator, while 'become a local administrator on the device' points to this role.
Frequently Asked Questions
Why is Cloud Device Administrator wrong for adding Contoso Help Desk as a local admin?
Can Windows LAPS put Contoso Help Desk into the local Administrators group?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
JayHall 👍 4Answer is correct: Assign the Microsoft Entra Joined Device Local Administrator role to Contoso Help Desk. The Microsoft Entra Joined Device Local Administrator role grants users local administrator rights on devices that are joined to Microsoft Entra ID. Users assigned to this role are added to the local administrators group on Azure AD-joined devices1. This allows them to perform tasks requiring administrative privileges, such as installing applications or making system changes https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin
-
Moot2 👍 1 Answered Bcorrect
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All MD-102 Questions
Access 92 questions with complete answers and detailed explanations.
View Full MD-102 Practice Test →