Add User or Group to Local Admin Using Intune

ℹ️

What this does: Adds an Entra ID user or security group to the local Administrators group on Intune-managed Windows devices — without touching existing members. Works on Windows 10 and Windows 11, both Entra-joined and hybrid-joined.

Contents

Step 1 — Identify the user or group
Step 2 — Create an Account Protection policy
Step 3 — Sync Intune policies to the device
Step 4 — Monitor deployment status
Step 5 — Verify on the device

Step 1

Identify the User or Group

Decide whether you want to add an individual Entra ID user account or an Entra security group. Using a security group is recommended for scale — add users to the group and the policy applies automatically.

Make sure the account exists in Entra ID (Azure AD) before proceeding. Note the exact display name or UPN — you'll need it when selecting in the policy.

Step 2

Create an Account Protection Policy

Navigate to the Intune admin center and create a new Account Protection policy targeting the Local user group membership profile.

2.1

Open Account Protection

2.2

Select Platform and Profile

Platform: Windows
Profile: Local user group membership
Click Create.

2.3

Basics Tab

Give the policy a clear Name and Description — e.g. LocalAdmin-Add-Helpdesk. Click Next.

2.4

Configuration Settings

Set the following values:

Local group: Administrators
Group or user action: Add (Update)
User selection type: Users/Groups
Selected users/groups: Click Select users/groups and choose the Entra ID user or security group you want to add.

💡

Add (Update) — adds the selected members without touching any existing group members. This is the safest option.

Add (Replace) — replaces the entire group membership with only the members you specify. Use with caution.

Remove (Update) — removes specific members from the local admin group without affecting others.

2.5

Scope Tags (Optional)

Add scope tags if your organisation uses RBAC to limit admin visibility. Skip if not applicable and click Next.

2.6

Assignments

Assign the policy to the Entra security group that contains the target devices. Best practice: pilot with a small test group first, then expand once confirmed working.

2.7

Review + Create

Review the summary and click Create. The policy is now live and will apply at the next device check-in.

Step 3

Sync Intune Policies to the Device

Policy delivery isn't instant. To speed it up on a test device, trigger a manual sync using one of these methods:

→

From the device — Settings app

Settings → Accounts → Access work or school → click your account → Info → Sync

→

From the device — PowerShell

Run as admin to immediately trigger the Intune Management Extension check-in:

Get-ScheduledTask | Where-Object {$_.TaskName -like "*PushLaunch*"} | Start-ScheduledTask

→

Remotely — from Intune admin center

Devices → All Devices → select the device → Sync. Or simply restart the device to trigger check-in.

Step 4

Monitor Deployment Status

Check that the policy applied successfully before verifying on the device.

→

Open the policy in Intune

Endpoint Security → Account Protection → click the policy you created.

→

Check device check-in status

Under Device and user check-in status, confirm the device shows Succeeded. Click Device assignment status or Per setting status for more detail if the status isn't as expected.

Step 5

Verify on the Device

Confirm the user or group has been added to the local Administrators group directly on the target device.

→

Open Computer Management

Press Start → search for Computer Management → open it.

→

Check the Administrators group

Local Users and Groups → Groups → double-click Administrators. The Entra ID user or group should appear in the members list.

💡

You can also verify quickly via PowerShell on the device:

Get-LocalGroupMember -Group "Administrators"

Add a User or Group to Local Admin Using Intune