Feature 21955 - Manage the local administrators on Microsoft Entra joined devices #708

praneeth-0000 · 2025-12-15T03:46:05Z

Rewrote the assessment logic as per new spec

Pass Scenario

Fail Scenario

Closes #678

alexandair · 2025-12-15T22:51:30Z

@merill @ramical
If I understand the article in Remediation action section correctly, it's recommended to use Intune method and leave the tenant-wide role empty.

You can use Microsoft Entra groups to manage administrator privileges on Microsoft Entra joined devices with the Local Users and Groups mobile device management (MDM) policy. This policy allows you to assign individual users or Microsoft Entra groups to the local administrators group on a Microsoft Entra joined device, providing you with the granularity to configure distinct administrators for different groups of devices.
Organizations can use Intune to manage these policies using Custom OMA-URI Settings or Account protection policy.

The current test fails organizations that implemented this recommendation.

alexandair

Left the comment for @merill and @ramical to confirm if the spec is correct.

ramical · 2025-12-17T22:35:53Z

src/powershell/tests/Test-Assessment.21955.md

 **Remediation action**

- [Manage the local administrators on Microsoft Entra joined devices](https://learn.microsoft.com/entra/identity/devices/assign-local-admin?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#manage-the-microsoft-entra-joined-device-local-administrator-role)
+- [Manage the local administrators on Microsoft Entra joined devices](https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin)


Per doc's guidance we should not include locales so I suggest not including the /en-US part

I don't know who and why has changed that URL. Tracking parts of the URL are added during the build process.

Btw, most (if not all) of the specs are using "en-us" locale.

In the docx, the link has en-us, Could you please let me know what I should keep there instead of en-us?

I always remove "en-us" when I code.
However, I think that links in that section are overwritten by build process anyway. @merill can confirm that.

src/powershell/tests/Test-Assessment.21955.ps1

ramical

Added a couple of comments. Once you address, pls check in

alexandair · 2025-12-17T22:58:34Z

@merill @ramical If I understand the article in Remediation action section correctly, it's recommended to use Intune method and leave the tenant-wide role empty.

You can use Microsoft Entra groups to manage administrator privileges on Microsoft Entra joined devices with the Local Users and Groups mobile device management (MDM) policy. This policy allows you to assign individual users or Microsoft Entra groups to the local administrators group on a Microsoft Entra joined device, providing you with the granularity to configure distinct administrators for different groups of devices.
Organizations can use Intune to manage these policies using Custom OMA-URI Settings or Account protection policy.

The current test fails organizations that implemented this recommendation.

@ramical Any comment on this?

ramical · 2025-12-18T02:52:04Z

Fair point and thanks for connecting the dogts. This is a great cross-pillar scenario where we can use some advice from our Intune specialist. @Clay-Microsoft wondering if you can weigh in? From Entra, we have policy plane to inject local admins to entra devices and seems that intune does too. So what's the best practice here?

SagarSathe · 2026-01-06T08:22:08Z

Fair point and thanks for connecting the dogts. This is a great cross-pillar scenario where we can use some advice from our Intune specialist. @Clay-Microsoft wondering if you can weigh in? From Entra, we have policy plane to inject local admins to entra devices and seems that intune does too. So what's the best practice here?

@Clay-Microsoft - Need you inputs on this.

SagarSathe · 2026-01-13T08:32:54Z

Response from Clay - "Account protection policies via Intune are generally the preferred and better path. That is what we recommend."

Copilot

Pull request overview

This PR rewrites the assessment logic for Test-Assessment.21955 to check if local administrators on Microsoft Entra joined devices are properly managed by querying role assignments from the database instead of querying a device registration policy API endpoint.

Changes:

Replaced Graph API policy check with database query for Microsoft Entra Joined Device Local Administrator role assignments
Added detailed reporting tables showing active (permanent) and eligible role assignments with user/group details
Updated documentation to provide more comprehensive security threat context

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/powershell/tests/Test-Assessment.21955.ps1	Rewrote assessment logic to query vwRole database view for role assignments instead of device registration policy, added detailed reporting with tables for permanent and eligible members
src/powershell/tests/Test-Assessment.21955.md	Expanded threat description with detailed attack scenario explanation, updated documentation link

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/powershell/tests/Test-Assessment.21955.ps1

src/powershell/tests/Test-Assessment.21955.md

Co-authored-by: Copilot <[email protected]>

alexandair

@praneeth-0000
Please, address my feedback.

src/powershell/tests/Test-Assessment.21955.ps1

alexandair · 2026-01-16T10:01:55Z

src/powershell/tests/Test-Assessment.21955.ps1

    [ZtTest(
    	Category = 'Devices',
    	ImplementationCost = 'Low',
    	MinimumLicense = ('Free'),


License Requirement Mismatch:
The code specifies MinimumLicense = 'Free', but the official Microsoft documentation for managing "Microsoft Entra Joined Device Local Administrator" states:

"This option requires Microsoft Entra ID P1 or P2 licenses."

Additionally, the test logic checks for Eligible assignments (PIM), which definitely requires an Entra ID P2 license. Since the passing condition allows for either permanent (P1) or eligible (P2) assignments, the minimum license to effectively use the feature being tested is at least P1.

Someone from Identity team needs to confirm this.

Hi @SagarSathe , previously the 21955 spec contained the minimum license as free but after the spec was re written they are not mentioned in docx. Like @alexandair mentioned, this has to be updated based on new logic.

alexandair · 2026-01-16T10:10:12Z

src/powershell/tests/Test-Assessment.21955.ps1

    	MinimumLicense = ('Free'),
    	Pillar = 'Identity',
    	RiskLevel = 'High',
    	SfiPillar = 'Protect tenants and isolate production systems',


The spec specifies "Secrets or Protect identities".

Hi @SagarSathe , need confirmation on SFI Pillar, previous version of Spec 21955 mentioned "Protect tenants and isolate production systems" after the revamp the details were not present in the spec.

praneeth-0000 added 2 commits December 15, 2025 09:00

rewrote the assessment logic as per new spec

c0fc8c3

added missing db param

a70ed6d

praneeth-0000 requested review from SagarSathe, alexandair and merill December 15, 2025 03:46

praneeth-0000 self-assigned this Dec 15, 2025

praneeth-0000 added the enhancement New feature or request label Dec 15, 2025

alexandair reviewed Dec 15, 2025

View reviewed changes

ramical reviewed Dec 17, 2025

View reviewed changes

src/powershell/tests/Test-Assessment.21955.ps1 Outdated Show resolved Hide resolved

ramical requested changes Dec 17, 2025

View reviewed changes

removed old portal link

c1aa410

updated table header links

8947bac

alexandair requested a review from Copilot January 16, 2026 07:41

Copilot started reviewing on behalf of alexandair January 16, 2026 07:41 View session

Copilot AI reviewed Jan 16, 2026

View reviewed changes

src/powershell/tests/Test-Assessment.21955.ps1 Outdated Show resolved Hide resolved

src/powershell/tests/Test-Assessment.21955.md Outdated Show resolved Hide resolved

praneeth-0000 and others added 2 commits January 16, 2026 13:23

Updated db query for consistency

c87641b

Co-authored-by: Copilot <[email protected]>

fixed grammatical mistake in md file

7e7d08b

Co-authored-by: Copilot <[email protected]>

praneeth-0000 requested a review from alexandair January 16, 2026 08:26

alexandair reviewed Jan 16, 2026

View reviewed changes

added variable for portal link

c9ac6b0

Feature 21955 - Manage the local administrators on Microsoft Entra joined devices #708

Are you sure you want to change the base?

Feature 21955 - Manage the local administrators on Microsoft Entra joined devices #708

Uh oh!

Conversation

praneeth-0000 commented Dec 15, 2025

Uh oh!

alexandair commented Dec 15, 2025

Uh oh!

alexandair left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ramical left a comment

Choose a reason for hiding this comment

Uh oh!

alexandair commented Dec 17, 2025

Uh oh!

ramical commented Dec 18, 2025

Uh oh!

SagarSathe commented Jan 6, 2026

Uh oh!

SagarSathe commented Jan 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

alexandair left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants