Grant Local Administrator Rights on Entra-Joined Devices via Intune

Users occasionally need local administrator rights on their corporate Windows devices to install developer tools (Visual Studio Code, Docker, Node.js), run legacy applications that require elevation, or troubleshoot driver issues. On Microsoft Entra joined devices, the local Administrators group is managed by Entra ID during the join process — modifications after the fact require either a directory role assignment, an Intune Account Protection policy (LocalUsersAndGroups CSP), or, ideally, Endpoint Privilege Management (EPM) for just-in-time elevation.

This recipe walks through the three common approaches, their trade-offs, and how to choose the right one for a given request. It replaces the common (but insecure) practice of directly adding users to the local Administrators group via PowerShell on the device, which is untracked and survives re-imaging.

• The target user can perform administrative actions (install software, change system settings) on the designated Entra-joined device(s).
• The grant is tracked centrally in Entra ID or Intune — visible, auditable, and reversible.
• You have a documented justification and scope for the grant (tenant-wide, device-scoped, or just-in-time).
• The change complies with least-privilege principles, with an expiration or review date where appropriate.

Security considerations

• The Microsoft Entra Joined Device Local Administrator role is tenant-wide. Assigning it grants local admin on every Entra-joined device in the tenant, not just one laptop. Do not use it as a one-off fix.
• Intune Account Protection (LocalUsersAndGroups) policies are device-scoped via group assignment. Prefer this over the directory role when you need to limit scope.
• Endpoint Privilege Management (EPM) is the modern, preferred approach — it grants elevation for specific executables on demand rather than standing admin rights. Requires an Intune Suite or EPM add-on license.
• Permanent local admin weakens endpoint security. A compromised user account with local admin can disable Defender, install persistent malware, and extract credentials from LSASS.
• Propagation is not instant. Directory role changes can take up to 4 hours and require sign-out/sign-in. Intune policy application depends on the next device check-in (typically 8 hours, can be forced).
• Log and review. Every local admin grant should have a ticket, a justification, and a planned expiration or quarterly review.

Do not

• Do not RDP to the device and add the user to the Administrators group manually — the change is invisible to Intune/Entra and will be overwritten by policy.
• Do not add users to the Global Administrator or Entra Joined Device Local Administrator roles to solve a single-device problem.