#Modern Workplace

Back in May 2021, I had published a blog post on setting local admin account using different options available in Intune . While the methods covered in the post still hold up, there is another option available natively in Azure that can be used to setup additional local administrators on Azure AD joined devices. The option involves using Additional local administrators on all Azure AD joined devices  feature in Azure which I didn't cover at the time because of its limitations. Primary limitation being that the user accounts added as additional local admin, also get added to all AAD joined devices. However, while exploring alternatives to a LAPS like solution for a customer recently, I stumbled upon Azure AD role  Azure AD Joined Device Local Administrator. The possibility of using it together with Privileged Identity Management (PIM) within  Additional local administrators on all Azure AD joined devices  feature intrigued me and I just had to try it out. Why Azu...

Security has always been and will always be an important subject and with the increasing number of recent security attacks, I felt compelled to cover the topic of setting local admin accounts on endpoints. Before the landscape of Modern workplace even came into picture, setting a local admin account ( aka break glass account ) has been a common practice. Now that more and more organizations are adopting Modern Workplace framework, this requirement has just evolved. I must point out that even though setting a local admin account is extremely useful and the fact that it allows administrators to perform elevated admin tasks, from a security standpoint it is not such a good idea. But more on that later. Let's see what are the different ways to set the local admin account using Intune. In case of a Domain Account - When you connect a Windows device with Azure AD using Azure AD join, Azure AD adds the following security principals to the local administrators group on the device: - The Az...