Feature 21955 - Manage the local administrators on Microsoft Entra joined devices

[praneeth-0000]

Rewrote the assessment logic as per new spec

• Pass Scenario

• Fail Scenario

• Skip Scenario (When Intune license is present)

Closes #678

[alexandair]

@merill @ramical
If I understand the article in Remediation action section correctly, it's recommended to use Intune method and leave the tenant-wide role empty.

You can use Microsoft Entra groups to manage administrator privileges on Microsoft Entra joined devices with the Local Users and Groups mobile device management (MDM) policy. This policy allows you to assign individual users or Microsoft Entra groups to the local administrators group on a Microsoft Entra joined device, providing you with the granularity to configure distinct administrators for different groups of devices.
Organizations can use Intune to manage these policies using Custom OMA-URI Settings or Account protection policy.

The current test fails organizations that implemented this recommendation.

[alexandair]

Left the comment for @merill and @ramical to confirm if the spec is correct.

[ramical]

Added a couple of comments. Once you address, pls check in

[alexandair]

@merill @ramical If I understand the article in Remediation action section correctly, it's recommended to use Intune method and leave the tenant-wide role empty.

You can use Microsoft Entra groups to manage administrator privileges on Microsoft Entra joined devices with the Local Users and Groups mobile device management (MDM) policy. This policy allows you to assign individual users or Microsoft Entra groups to the local administrators group on a Microsoft Entra joined device, providing you with the granularity to configure distinct administrators for different groups of devices.
Organizations can use Intune to manage these policies using Custom OMA-URI Settings or Account protection policy.

The current test fails organizations that implemented this recommendation.

@ramical Any comment on this?

[ramical]

Fair point and thanks for connecting the dogts. This is a great cross-pillar scenario where we can use some advice from our Intune specialist. @Clay-Microsoft wondering if you can weigh in? From Entra, we have policy plane to inject local admins to entra devices and seems that intune does too. So what's the best practice here?

[SagarSathe]

Fair point and thanks for connecting the dogts. This is a great cross-pillar scenario where we can use some advice from our Intune specialist. @Clay-Microsoft wondering if you can weigh in? From Entra, we have policy plane to inject local admins to entra devices and seems that intune does too. So what's the best practice here?

@Clay-Microsoft - Need you inputs on this.

[SagarSathe]

Response from Clay - "Account protection policies via Intune are generally the preferred and better path. That is what we recommend."

[Copilot]

Pull request overview

This PR rewrites the assessment logic for Test-Assessment.21955 to check if local administrators on Microsoft Entra joined devices are properly managed by querying role assignments from the database instead of querying a device registration policy API endpoint.

Changes:

• Replaced Graph API policy check with database query for Microsoft Entra Joined Device Local Administrator role assignments
• Added detailed reporting tables showing active (permanent) and eligible role assignments with user/group details
• Updated documentation to provide more comprehensive security threat context

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/powershell/tests/Test-Assessment.21955.ps1	Rewrote assessment logic to query vwRole database view for role assignments instead of device registration policy, added detailed reporting with tables for permanent and eligible members
src/powershell/tests/Test-Assessment.21955.md	Expanded threat description with detailed attack scenario explanation, updated documentation link

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[alexandair]

@praneeth-0000
Please, address my feedback.

[alexandair]

@praneeth-0000 Please, address my feedback.

[alexandair]

LGTM

[merill]

After discussing the @ramical and @KalwaniRavi we've decided to make one more change to this test.

If the tenant has any Intune licenses, this test should be Skipped with the reason as 'Not applicable for tenants with Intune'. This is because the other intune test 'Local account usage on Windows is restricted to reduce unauthorized access' handles the scenario.