Grant Local Administrator Rights on Entra-Joined Devices via Intune

Option A — Tenant-wide: Microsoft Entra Joined Device Local Administrator role

Use when a helpdesk or engineering group needs admin on all corporate devices.

1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.
2. Navigate to Identity > Devices > All devices > Device settings.
3. Locate Manage Additional local administrators on all Microsoft Entra joined devices and select it.
4. Click Add assignments, search for the target user or group, and click Add.
5. Allow up to 4 hours for propagation. The user must sign out and back into Windows for the new token (including the admin group) to take effect.

Requires Microsoft Entra ID P1 or P2.

Option B — Device-scoped: Intune Account Protection policy (preferred for single-user grants)

1. Sign in to the Microsoft Intune admin center.
2. Navigate to Endpoint security > Account protection > Create Policy.
3. Platform: Windows 10 and later. Profile: Local user group membership. Click Create.
4. Name the policy (e.g., Local Admins - Developers) and click Next.
5. Add a rule:
   • Local group: Administrators
   • Group and user action: Add (Update)
   • User selection type: Users / Groups
   • Select the Entra user(s) or group(s) that should get local admin.
6. Click Next, apply scope tags if used, then assign the policy to a security group that contains the target device(s). Do not assign to All Devices.
7. Review and create. The policy applies at the next device check-in (force from Company Portal or dsregcmd /status + sync).

Option C — Just-in-time: Endpoint Privilege Management (EPM)

1. Ensure the tenant has the Intune Suite or EPM add-on license assigned.
2. In Intune, navigate to Endpoint security > Endpoint Privilege Management.
3. Create an Elevation settings policy and assign it to the device group to enable the EPM client.
4. Create an Elevation rules policy that allows the specific installer (e.g., VSCodeUserSetup-x64-*.exe) to run elevated, either automatically or with user-confirmed / support-approved flow.
5. Publish and assign. The user right-clicks the installer and selects Run with elevated access — no standing admin rights required.

Option A — Assign the directory role (Graph API)

First, ensure the role is activated in the tenant. Entra Joined Device Local Administrator role template ID is 9f06204d-73c1-4d4c-880a-6edb90606fd8.

1. Activate the role (one-time, if not already activated)

POST https://graph.microsoft.com/v1.0/directoryRoles
Content-Type: application/json

{
  "roleTemplateId": "9f06204d-73c1-4d4c-880a-6edb90606fd8"
}

2. Look up the activated role's object ID

GET https://graph.microsoft.com/v1.0/directoryRoles?$filter=roleTemplateId eq '9f06204d-73c1-4d4c-880a-6edb90606fd8'

3. Add the user as a member

POST https://graph.microsoft.com/v1.0/directoryRoles/{roleId}/members/$ref
Content-Type: application/json

{
  "@odata.id": "https://graph.microsoft.com/v1.0/directoryObjects/{userObjectId}"
}

Response: 204 No Content. The user becomes local admin on all Entra-joined devices after propagation.

Option B — Create a scoped Intune Account Protection policy

Use the configurationPolicies endpoint with the windows10 platform and the LocalUsersAndGroups settings catalog template.

POST https://graph.microsoft.com/beta/deviceManagement/configurationPolicies
Content-Type: application/json

{
  "name": "Local Admins - {group_name}",
  "description": "Grants local admin to {user} for dev tool installation",
  "platforms": "windows10",
  "technologies": "mdm",
  "templateReference": {
    "templateId": "22968f54-45fa-486c-848e-f8224aa69772_1"
  },
  "settings": [ /* LocalUsersAndGroups configure action with target SID */ ]
}

Assign the policy to a device group

POST https://graph.microsoft.com/beta/deviceManagement/configurationPolicies/{policyId}/assign

{
  "assignments": [{
    "target": {
      "@odata.type": "#microsoft.graph.groupAssignmentTarget",
      "groupId": "{targetGroupId}"
    }
  }]
}

Force a device sync so the policy applies sooner

POST https://graph.microsoft.com/beta/deviceManagement/managedDevices/{managedDeviceId}/syncDevice

Overview

The script below performs Option B — the recommended scoped approach. It takes a user UPN and a device name, looks up both, ensures a dedicated assignment group exists, adds the device to it, and creates (or updates) an Intune Account Protection policy that adds the user to the local Administrators group on that device only.

Prerequisites

• Microsoft.Graph PowerShell SDK: Install-Module Microsoft.Graph -Scope CurrentUser
• Permissions: DeviceManagementConfiguration.ReadWrite.All, DeviceManagementManagedDevices.Read.All, Group.ReadWrite.All, User.Read.All
• Caller is a Privileged Role Administrator or Intune Administrator

Usage

Connect-MgGraph -Scopes "DeviceManagementConfiguration.ReadWrite.All","DeviceManagementManagedDevices.Read.All","Group.ReadWrite.All","User.Read.All"

.\Grant-LocalAdmin.ps1 -UserPrincipalName user@contoso.com -DeviceName LAPTOP-001 -Justification "Install VS Code for dev work" -ExpirationDays 30

The -ExpirationDays parameter records a review date in the policy description so the grant does not become permanent by neglect. Combine with a scheduled job that runs Get-MgDeviceManagementConfigurationPolicy and flags policies past their review date.