MT.1090 - Global Administrator role should not be added as local administrator on the device during Microsoft Entra join
Overview
The 'Global Administrator role is added as local administrator on the device during Microsoft Entra join' setting determines if Microsoft Entra Global Administrator role is added to the local administrators group. This setting applies only once during the actual registration of the device as Microsoft Entra join.
Remediation action
Within the Entra Portal - Device Settings set 'Global Administrator role is added as local administrator on the device during Microsoft Entra join' to No. To remediate existing devices, you need to create an Intune account policy, overriding the built-in Windows Administrators group.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1090 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Device identity |
| Area | Privileged access |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:AC-6 |
| PowerShell test | Test-MtDeviceRegistrationLocalAdminsGlobalAdmin |
| Services | Graph |
Source
- Test:
tests/maester/entra/Test.MT.1090.ps1 - Documentation:
tests/maester/entra/Test.MT.1090.md