The Microsoft Entra Joined Device Local Administrator role is specifically designed to grant administrative privileges on all Microsoft Entra joined devices. By assigning this role to the "Contoso Help Desk" group, all members of that group will be automatically added to the local Administrators group on every device that is joined to the contoso.com tenant. This provides a centralized way to manage local administrative rights across the organization's devices.

A. Assign the Cloud Device Administrator role to Contoso Help Desk: This role grants permissions to manage device objects within Microsoft Entra ID (e.g., enabling or disabling devices), not local administrator rights on the devices themselves. C. Configure the Enterprise State Roaming settings: This feature synchronizes user settings and application data across devices. It is unrelated to assigning local administrative permissions. D. Enable Microsoft Entra Local Administrator Password Solution (LAPS) for contoso.com: LAPS manages the password of a single, built-in local administrator account on each device. It does not add additional users or groups to the local Administrators group.

1. Microsoft Entra Documentation. "How to manage the local administrators group on

Microsoft Entra joined devices." Microsoft Learn. This document explicitly states, "To add a

Microsoft Entra group to the local administrators group, assign it the Microsoft Entra Joined

Device Local Administrator role."

URL: https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin#managethe-microsoft-entra-joined-device-local-administrator-role

2. Microsoft Entra Documentation. "Microsoft Entra built-in roles." Microsoft Learn. This

page details the permissions for various roles, differentiating the "Cloud Device

Administrator" (manages device objects in the cloud) from the "Microsoft Entra Joined

Device Local Administrator" (grants local admin on the device).

URL: https://learn.microsoft.com/en-us/entra/identity/role-based-accesscontrol/permissions-reference#microsoft-entra-joined-device-local-administrator

3. Microsoft Entra Documentation. "What is Windows LAPS?" Microsoft Learn. This source

explains that LAPS is for securing and managing the password of a single local

administrator account, not for granting permissions to other groups.

URL: https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview