Device identity management
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 701eb5f · +3 −2 lines · also on GitHub
⋯ 1 unchanged line
22
title: Manage devices in Microsoft Entra ID using the Microsoft Entra admin center
33
description: This article describes how to use the Microsoft Entra admin center to manage device identities and monitor related event information.
44
ms.topic: how-to
5
−ms.date: 02/03/2026
5
+ms.date: 06/17/2026
66
ms.reviewer: myra-ramdenbourg
77
ms.custom: sfi-image-nochange
88
---
⋯ 167 unchanged lines
176176
> [!NOTE]
177177
> The **Maximum number of devices** setting applies to devices that are either Microsoft Entra joined or Microsoft Entra registered. This setting doesn't apply to Microsoft Entra hybrid joined devices.
178178
179
−- **Manage Additional local administrators on Microsoft Entra joined devices**: This setting allows you to select the users who are granted local administrator rights on a device. These users are added to the Device Administrators role in Microsoft Entra ID.
179
+- **Manage Additional local administrators on Microsoft Entra joined devices**: This setting lets you select users who are granted local administrator rights on all Microsoft Entra joined devices in the tenant. These users are assigned to the Microsoft Entra Joined Device Local Administrator role, which applies tenant-wide.
180
+- **Registering user is added as local administrator on the device during Microsoft Entra join**: This setting controls whether users who perform Microsoft Entra join are added to the local Administrators group on the device they join. This setting affects local device administrator membership only. It doesn't assign a Microsoft Entra directory role, such as Global Administrator, and it doesn't add the user to the Microsoft Entra Joined Device Local Administrator role. To verify the result, check the local Administrators group on the device or use a device management tool. In Microsoft Graph, this setting is represented by the `azureADJoin.localAdmins.registeringUsers` property of the [device registration policy](/graph/api/resources/deviceregistrationpolicy).
180181
- **Enable Microsoft Entra Local Administrator Password Solution (LAPS) (preview)**: LAPS is the management of local account passwords on Windows devices. LAPS provides a solution to securely manage and retrieve the built-in local admin password. With cloud version of LAPS, customers can enable storing and rotation of local admin passwords for both Microsoft Entra ID and Microsoft Entra hybrid join devices. To learn how to manage LAPS in Microsoft Entra ID, see [the overview article](howto-manage-local-admin-passwords.md).
181182
182183
- **Restrict non-admin users from recovering the BitLocker key(s) for their owned devices**: Admins can block self-service BitLocker key access to the registered owner of the device. Default users without the BitLocker read permission are unable to view or copy their BitLocker key(s) for their owned devices. You must be at least a [Privileged Role Administrator](../role-based-access-control/permissions-reference.md#privileged-role-administrator) to update this setting.
⋯ 46 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.