MT.1090: Global Administrator role should not be added as local administrator on the device during Microsoft Entra join
| ID | MT.1090 |
| Severity | Medium |
| Suite | Mito |
| Product | Entra ID |
| Feature | Device identity |
| Security area | Privileged access |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:AC-6 Least Privilege |
| MITRE ATT&CK | T1078.004 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”The ‘Global Administrator role is added as local administrator on the device during Microsoft Entra join’ setting determines if Microsoft Entra Global Administrator role is added to the local administrators group. This setting applies only once during the actual registration of the device as Microsoft Entra join.
Remediation action
Section titled “Remediation action”Within the Entra Portal - Device Settings set ‘Global Administrator role is added as local administrator on the device during Microsoft Entra join’ to No. To remediate existing devices, you need to create an Intune account policy, overriding the built-in Windows Administrators group.
Related links
Section titled “Related links”Mito check. Author: nicolonsky. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.