How do I add Azure Active Directory User to Local Administrators Group? (4 Solutions!!)
Channel: Roel Van de Paar
Date: 2020-08-19

How do I add Azure Active Directory User to Local Administrators Group?


The Question: With Windows 10 you can join an organisation (=Azure Active Directory) and
login with your cloud credentials.
Based on the information provided http://thebillablelife.com/windows-10-
enterprise-azure-ad-join-vs-workplace-join-in-office-365/ the first account per
computer that joins the organisation is a local administrator. The accounts
that join after that are not.
How do I make them local administrators?
The standard group add dialog does not allow me to select users from AzureAD,
search from users from AzureAD. I simply can see that my first account is in
the list (listed as AzureAD\AccountName).
Interesting is also: When I login with the second account and get prompted for
a local administrator (for applying computer settings - UAC I assume) it will
not accept the first account even though it is a local administrator.

Solutions: Please watch the whole video to see all solutions, in order of how many people found them helpful

== This solution helped 1 person ==
My experience is also there is no option available to add a single AAD account
to the local adminstrator group. What you can do is add additional
administrators for ALL devices that have joined the Azure AD. You can do his
through the azure console on https://manage.windowsazure.com for which you need
an AAD license). You can find this option by clicking on your tenant name and
click on the 'configure' tab. Look for the 'devices' section.
This means that two AAD users can not be local admin on the same device at the
same time, unless one of the users is a global admin for all devices... In the
case the windows machine has to change owner, that needs also local admin
rights on the specific machine, you need to de-join from AAD and re-join using
the new owner user account.
I tried this and to my surprise the built-in local administrator did not have
permissions to join Azure AD. Clicking the button didn't give any reply. Only
after adding another local administrator account and log in locally with that
user I could start the join process. In the login screen I specified the Azure
AD/0365 user. That one became local admin correctly.
See also the blog below:
http://blogs.technet.com/b/ad/archive/2015/05/28/azure-ad-join-on-windows-10-
devices.aspx

== This solution helped 43 people ==
You can do this via command line! I just had this same issue and after
searching and getting nothing but "you can't" from everywhere, I (for giggles
and grins) tried this through the command line and IT WORKED!!
 1. Login to the PC as the Azure AD user you want to be a local admin. This
 gets the GUID onto the PC.
 2. Log out as that user and login as a local admin user.
 3. Open a command prompt as Administrator and using the command line, add
 the user to the administrators group. As an example, if I had a user
 called John Doe, the command would be "net localgroup administrators
 AzureADJohnDoe /add" without the quotes.
Log back in as the user and they will be a local admin now.

== This solution helped 1 person ==
I just landed here with a similar problem - how do I add my Azure user to the
local "Hyper-V Administrators" group.
Apart from the best-rated answer (thanks!), turns out you can with the
following PS command as well:
PS＞ ([adsi]"WinNT://./Hyper-V Administrators,group").Add("WinNT://$env:
UserDomain/$env:Username,user")
which I found on https://docs.okd.io/latest/minishift/troubleshooting/
troubleshooting-driver-plugins.html#troubleshooting-driver-hyperv

With thanks & praise to God, and with thanks to the many people who have made this project possible! | Content (except music & images) licensed under cc by-sa 3.0 | Music: https://www.bensound.com/royalty-free-music | Images: https://stocksnap.io/license & others | With thanks to user zx485 (https://superuser.com/users/427002), user SergG (https://superuser.com/users/1167101), user Pawel Gorczynski (https://superuser.com/users/965148), user Cyril (https://superuser.com/users/523042), user Chris Angell (https://superuser.com/users/559803), user Alex Duggleby (https://superuser.com/users/23594), and the Stack Exchange Network (http://superuser.com/questions/982336). Trademarks are property of their respective owners. Disclaimer: All information is provided "AS IS" without warranty of any kind. You are responsible for your own actions. Please contact me if anything is amiss at Roel D.OT VandePaar A.T gmail.com.