(124) Microsoft Entra - Global Administrator as Local Administrator

Microsoft recently mad some changes last month where now anyone that has a 'Global Administrator' role assigned will be a local administrator on a device during entra joined enrolment.

You can navigate here.

With the first setting 'Global administrator role is added as local administrator on the device during Microsoft Entra join', that means any user who has a global admin role will be added to the administrators group

My recommendation is set the below to "No" > Global administrator role is added as local administrator on the device during Microsoft Entra join set to "No" > Registering user is added as local administrator on the device during Microsoft Entra join set to "No"

Save the changes.