New Laptop - Signed in with Work Account and now no admin privledges

Rob C 20 Reputation points
2026-03-02T16:35:10.6666667+00:00

I am the owner - sole employee of my business. I have Windows 11 Pro and a license for M365 Business Basics. I bought a new computer and am trying to set it up but whenever I try to do anything (like install a program) the User Account Control pops up. If I enter my business email and Microsoft password then I get the error message 'the requested operation requires elevation'.

In doing some research I learned that:

  1. being the sole user I was global admin
  2. global admin doesnt apply to local pcs. So I learned I should go to Entra, which I never used before. I changed the settings under Devices > Device Settings such that "Global administrator role is added as local administrator on the device during Microsoft Entra join (Preview)" is now marked YES.

This didn't solve my issue. I cannot even reset my computer because it requires admin. I keep getting kicked around MSFT support from the commercial team to the consumer team and back again. The commercial team person was trying to "disconnect" my work Microsoft account on my laptop under Settings>Accounts>Access to School or Work but the "disconnect" button is grayed out. In Entra, we removed the device entirely.

User's image

I would appreciate any help thank you.

Windows for business | Windows 365 Business
0 comments
Answer accepted by question author
VPHAN 44,940 Reputation points Independent Advisor
2026-03-02T17:26:14.6733333+00:00

Rob C

Deleting the device from the Entra portal directly caused the current deadlock. While you can download the Media Creation Tool on your locked PC, running the application requires formatting a drive, which will immediately trigger the same User Account Control elevation prompt you are currently trapped by. Therefore, you must use your wife's Mac to create the bootable USB. Because the Media Creation Tool is a Windows-only executable, it will not run on macOS. Instead, when you visit the official Windows 11 download page on the Mac, Microsoft will automatically detect the operating system and redirect you to download the Windows 11 disk image (ISO) directly. You can then use a free utility on the Mac to flash this ISO file onto your USB drive, making it bootable for the PC.

Regarding a remote fix, Microsoft support does not possess a backdoor to push configuration changes to your laptop. Because the device was deleted from the Entra directory, the cryptographic trust relationship and the Primary Refresh Token were completely destroyed. The laptop is now effectively orphaned from your tenant, meaning there is no active, secure management channel for Microsoft to send an unlock command or policy update. A clean installation from a USB drive remains the only technical avenue to bypass the local security barrier and wipe the system.

Setting up the laptop for personal use first after the reset is an excellent and highly recommended strategy for a sole proprietor. During the initial Windows setup, utilizing a personal Microsoft account guarantees your user profile is created with permanent local administrator privileges. Once you reach the desktop, you can easily bridge your business environment by navigating to Settings, selecting Accounts, and opening the Access work or school menu. By signing in there with your Microsoft 365 credentials, you register the device to your business tenant. This allows you to seamlessly use Outlook, Teams, and your business licenses while maintaining absolute, uncomplicated administrative control over the hardware through your initial personal profile.

Hope this answer brought you some useful information :)

VP

Was this answer helpful?

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. VPHAN 44,940 Reputation points Independent Advisor
    2026-03-02T17:09:46.1066667+00:00

    Hi Rob C,

    When you initially booted the computer and signed in with your Microsoft 365 credentials, the machine performed an Entra ID join. Because the specific Entra portal policy assigning Global Administrators as local administrators was not yet active, Windows provisioned your user profile with standard, restricted privileges. The disconnect button in your screenshot is grayed out because this work account serves as the primary cryptographic identity for the operating system, which Windows inherently prevents you from removing while actively logged in. Furthermore, by deleting the device object directly from the Entra portal, you severed the secure trust relationship and invalidated the Primary Refresh Token. This effectively orphans the device, leaving you permanently locked out of elevated privileges since there is no secondary local administrator account to authorize system changes or reset the computer from within your settings.

    Since the device is brand new and you are fully locked out of administrative functions, performing a clean installation of Windows 11 Pro is the most reliable and guaranteed path forward. While you could attempt to access the local Windows Recovery Environment by holding the Shift key and clicking Restart from the lock screen, selecting the option to remove everything may still prompt you for an administrator password or a BitLocker recovery key that you do not possess. The definitive, manufacturer-supported method to bypass this administrative deadlock is to create a bootable USB installation drive. You will need to access a separate, working computer and download the official Windows 11 Media Creation Tool from Microsoft's software download page to properly format a blank USB flash drive. Once the bootable USB is prepared, insert it into your locked laptop and access the motherboard's boot menu immediately upon powering it on, usually by tapping a designated function key like F12, F10, or F8 depending on your computer's manufacturer. Booting directly from the USB forces the system to load the Windows setup environment entirely outside of your locked local operating system. Progress through the initial setup screens until you reach the disk partition management window. Here, you must delete every existing partition on the primary drive until only unallocated space remains, then click next to initiate a completely fresh installation of Windows 11 Pro. After the installation completes and you arrive at the initial setup screen, sign in using your Microsoft 365 business email. Because your Entra portal is now properly configured to push the local administrator policy during the join process, your new profile will automatically be granted the elevated permissions necessary to install your software and configure your business environment.

    Hope this answer brought you some useful information. If it did, please hit "accept answer". Should you have any questions, feel free to leave a comment.

    VP

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.