Back to Checks
m365

Global Administrators are not added as local administrators during Entra join

entra_device_registration_global_admins_not_local_admins
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

The tenant device registration policy should not automatically add the Global Administrator role to the local administrators group of a device during the Microsoft Entra join process (azureADJoin.localAdmins.enableGlobalAdmins should be false).

Prowler logoProwlerprowler-provider-m365

Risk

Automatically granting Global Administrators local admin rights on every Entra-joined device broadens the blast radius of a device compromise and violates least privilege, since local admin rights on endpoints are rarely required for directory administration.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_device_registration_global_admins_not_local_admins

Recommendation

Disable the automatic addition of Global Administrators to the local administrators group during Microsoft Entra join and grant local admin rights only where required.

Remediation

Other

1Navigate to the Microsoft Entra admin center at https://entra.microsoft.com/
2Go to **Identity** > **Devices** > **Device settings**
3Set **Global administrator role is added as local administrator on the device during Microsoft Entra join** to **No**
4Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client


class entra_device_registration_global_admins_not_local_admins(Check):
    """Check if Global Administrators are not added as local admins on Entra join.

    The device registration policy should not automatically add the Global
    Administrator role to the local administrators group of a device during the
    Microsoft Entra join process.

    - PASS: Global Administrators are not added as local administrators on Entra join.
    - FAIL: Global Administrators are added as local administrators on Entra join.
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the Global Administrators local-admin restriction check.

        Returns:
            List[CheckReportM365]: A list containing the result of the check.
        """
        findings = []
        policy = entra_client.device_registration_policy
        if not policy:
            return findings

        report = CheckReportM365(
            metadata=self.metadata(),
            resource=policy,
            resource_name="Device Registration Policy",
            resource_id="deviceRegistrationPolicy",
        )
        report.status = "FAIL"
        report.status_extended = (
            "Global Administrators are added as local administrators on devices "
            "during Microsoft Entra join."
        )

        if policy.azure_ad_join_global_admins_enabled is False:
            report.status = "PASS"
            report.status_extended = (
                "Global Administrators are not added as local administrators on "
                "devices during Microsoft Entra join."
            )

        findings.append(report)
        return findings

References