How to add an Azure AD User as an administrator

How to add an Azure AD User as an administrator

Steps

Click Start > Type "Cmd" > Right Click and select "Run as Administrator".
  • If your tenant users are created in Azure AD, use net localgroup administrators /add "AzureAD\UserUpn"
  • Where UserUPN is the User's E-mail

How it works

When you connect a Windows device with Azure AD using an Azure AD join, Azure AD adds the following security principals to the local administrators group on the device:

  • The Azure AD global administrator role
  • The Azure AD joined device local administrator role
  • The user performing the Azure AD join

By adding Azure AD roles to the local administrators group, you can update the users that can manage a device anytime in Azure AD without modifying anything on the device. Azure AD also adds the Azure AD joined device local administrator role to the local administrators group to support the principle of least privilege (PoLP). In addition to the global administrators, you can also enable users that have been only assigned the device administrator role to manage a device.


Manually elevate a user on a device

In addition to using the Azure AD join process, you can also manually elevate a regular user to become a local administrator on one specific device. This step requires you to already be a member of the local administrators group.

Starting with the Windows 10 1709 release, you can perform this task from Settings -> Accounts -> Other users. Select Add a work or school user, enter the user's UPN under User account and select Administrator under Account type

Additionally, you can also add users using the command prompt:

  • If your tenant users are synchronized from on-premises Active Directory, use net localgroup administrators /add "Contoso\username".
  • If your tenant users are created in Azure AD, use net localgroup administrators /add "AzureAD\UserUpn"**
**This is the preferred method where UserUPN is the User's E-mail Address.