Back to Checks
m365

Registering user is not added as local administrator during Entra join

entra_device_registration_registering_user_not_local_admin
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

The tenant device registration policy should restrict which registering users are added to the local administrators group during Microsoft Entra join to Selected users or None (azureADJoin.localAdmins.registeringUsers), rather than granting local admin to every user who registers a device.

Prowler logoProwlerprowler-provider-m365

Risk

Automatically granting the registering user local administrator rights gives standard users elevated control over their devices, increasing the impact of endpoint compromise and enabling local privilege abuse.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_device_registration_registering_user_not_local_admin

Recommendation

Restrict or disable the automatic addition of the registering user to the local administrators group during Microsoft Entra join, granting local admin rights only to selected users where required.

Remediation

Other

1Navigate to the Microsoft Entra admin center at https://entra.microsoft.com/
2Go to **Identity** > **Devices** > **Device settings**
3Set **Registering user is added as local administrator on the device during Microsoft Entra join** to **Selected** or **None**
4Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client
from prowler.providers.m365.services.entra.entra_service import (
    DeviceRegistrationMembershipType,
)

RESTRICTED_MEMBERSHIP_TYPES = {
    DeviceRegistrationMembershipType.ENUMERATED.value,
    DeviceRegistrationMembershipType.NONE.value,
}


class entra_device_registration_registering_user_not_local_admin(Check):
    """Check if the registering user is not added as local admin on Entra join.

    The device registration policy should restrict which registering users are added
    to the local administrators group during Microsoft Entra join to Selected users
    or None, rather than all registering users.

    - PASS: Registering users are restricted (Selected or None) from becoming local
      administrators on Entra join.
    - FAIL: The registering users added as local administrators are not restricted
      to Selected or None.
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the registering-user local-admin restriction check.

        Returns:
            List[CheckReportM365]: A list containing the result of the check.
        """
        findings = []
        policy = entra_client.device_registration_policy
        if not policy:
            return findings

        report = CheckReportM365(
            metadata=self.metadata(),
            resource=policy,
            resource_name="Device Registration Policy",
            resource_id="deviceRegistrationPolicy",
        )
        report.status = "FAIL"
        report.status_extended = (
            "Registering users are not restricted from being added as local "
            "administrators on devices during Microsoft Entra join."
        )

        if policy.azure_ad_join_registering_users_type in RESTRICTED_MEMBERSHIP_TYPES:
            report.status = "PASS"
            report.status_extended = (
                "Registering users are restricted from being added as local "
                "administrators on devices during Microsoft Entra join."
            )

        findings.append(report)
        return findings

References