Joining devices to Entra ID: who can join, and who becomes local administrator?
Entra ID device settings are configured once, often during the first Intune rollout, and then forgotten. Yet they determine who can bring a device into the tenant, who becomes its administrator, and who can read the secrets protecting those machines.
Settings often left at their defaults
The Entra ID device settings page brings together options whose defaults favour ease of deployment: any user can join a device, the joining user becomes local administrator, and everyone can view the BitLocker key of their own devices. These choices make it easy to get started, but they do not add up to a controlled workstation.
Who can join and register devices
There are two separate settings: Microsoft Entra join, which makes the device an organisational machine, and registration, which records a personal device. For join, it is better to restrict the right to a defined group, or to use Windows Autopilot, rather than leaving it open to all users.
- MFA at join time: instead of the tenant-wide setting, use the "Register or join devices" user action in Conditional Access. The two mechanisms should not be combined.
- Maximum number of devices per user: the default value is high. A lower quota limits mass device registration by a compromised account, a known persistence technique.
- Stale devices: without a clean-up process, the directory accumulates inactive devices that blur the inventory and compliance policies.
Local administrators
When a device is joined to Microsoft Entra, several groups of people can receive local administrator rights:
| Population | Mechanism | Recommendation |
|---|---|---|
| User who joins the device | Tenant device setting | Disable, or use Autopilot with a standard account |
| Support administrators | Microsoft Entra Joined Device Local Administrator role | Assign through PIM, as eligible |
| Global Administrators | Tenant device setting | Do not make them workstation administrators |
| Targeted groups | Intune account protection policy | Preferred for fine-grained management |
The device local administrator role applies to every joined device: assigning it permanently gives a support account control over the entire fleet. Intune policies for local group membership allow more precise targeting.
Windows LAPS with Entra ID
The built-in local administrator account is still needed for troubleshooting. Windows LAPS backs up its password, unique per device and rotated automatically, to Entra ID. It must be enabled in the device settings and then deployed through an Intune policy. Reading these passwords is restricted to certain roles, including Cloud Device Administrator and Intune Administrator; check the current list in the documentation. Every retrieval is logged: it is an event worth monitoring, and the password should be rotated after use.
BitLocker recovery keys
BitLocker keys for joined devices are backed up to Entra ID. By default, a device owner can retrieve their key through self-service. The "Restrict users from recovering the BitLocker key(s) for their owned devices" setting routes this operation through the helpdesk. On the administration side, several built-in roles can read the keys, including Cloud Device Administrator and Helpdesk Administrator: a compromised support account therefore gives access to disk encryption secrets.
A deceptively modest role. Many teams do not regard Cloud Device Administrator as a critical role. Yet it can read the LAPS passwords and BitLocker keys of the whole fleet. Treat it accordingly.
What an audit checks
- Which users may join and register devices, and the per-user quota.
- How MFA is required at join time: tenant-wide setting or Conditional Access user action.
- Which accounts become local administrators, and assignments of the device local administrator role.
- Windows LAPS deployment and the list of accounts allowed to read passwords.
- Access to BitLocker keys, both through self-service and through administrative roles.