Local Administrator Assignments via Intune
The question it answers: Which users and groups do Intune policies add to the local Administrators group, on which devices?
Account protection policies can add users and groups to the local Administrators group of every device they target. A broad principal or an admin group on All devices turns one compromised account into admin rights everywhere. Prefer Windows LAPS for break-fix and Endpoint Privilege Management for elevation.
At a glance
Section titled “At a glance”| Where in the app | Intune › Device Operations & Hardening › Local Admins via Intune |
| Workload | Intune |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | Microsoft Intune. |
| Report id (API and MCP) | intune.operations.local-administrators |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Local group | Category | Text |
| Member | Subject | Link |
| Check | Setting | Text |
| Policy | Value | Text |
| Finding | Finding | Text |
| Action / assignment | Detail | Text |
| Date | When | Date |
| Count | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Microsoft Intune.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
DeviceManagementConfiguration.Read.All | Microsoft Graph | Read Microsoft Intune device configuration and policies |
Data sources it reads
GET /beta/deviceManagement/configurationPolicies?$expand=settings,assignments
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/intune.operations.local-administrators?size=100An AI assistant reads it with the MCP tool get_report and the id intune.operations.local-administrators. The client needs the Read grant for Intune. See Using the API.