AZ-104 Certification Practice Question #167

Question

You have an Azure Active Directory (Azure AD) tenant named adatum.com that contains the users shown in the following table.

Adatum.com has the following configurations:
✑ Users may join devices to Azure AD is set to User1.
✑ Additional local administrators on Azure AD joined devices is set to None.
You deploy Windows 10 to a computer named Computer1. User1 joins Computer1 to adatum.com.
You need to identify the local Administrator group membership on Computer1.
Which users are members of the local Administrators group?

Accepted Answer

When a Windows 10 computer is joined to Microsoft Entra ID (Azure AD) via an Entra Join, Azure AD automatically adds three security principals to the device's local Administrators group:
1. **The Global Administrator role**: User2 is the Global Administrator, so User2 is automatically added.
2. **The user performing the Entra join**: User1 performed the join, so User1 is automatically added.
3. **The Microsoft Entra Joined Device Local Administrator role**: This is configured via the "Additional local administrators on Azure AD joined devices" tenant setting. Since this setting is set to **None**, no additional users are added through this role.
Importantly, other directory roles like the **Cloud Device Administrator** role (which User3 has) only permit device management operations within the Entra admin center and do not grant local administrative permissions on the Windows client. Thus, only User1 and User2 are members of the local Administrators group.

More AZ-104 practice questions