PC is joined to non profit domain. Unable to elevate permissions for global admin user on the pc

Question

PC is joined to non profit domain. Unable to elevate permissions for global admin user on the pc

Konrad K 0

I have set up a non profit domain. I have a number of users including the global admin user (that I used to set up a pc)
When I try to install M365 business standard on the PC, using the global admin user, it requests elevated privileges.

neither M365 admin or Entra admin appear to have a specific setting for granting local admin access

0 comments

2 answers

Your answer

Answer 1

Hi @Konrad K

Based on my research, being a Global Administrator in Microsoft 365 or Microsoft Entra does not by itself confirm that the account currently has Local Administrator rights on the Windows device.

To better understand the issue, could you please confirm:

-Is the device Microsoft Entra joined or only connected to a work/school account?

-Does the device currently have another local Administrator account available?

-What exact message is displayed when the elevation prompt appears?

If the device is confirmed to be Microsoft Entra joined, you can also review Microsoft's guidance on managing local administrator permissions: How to manage local administrators on Microsoft Entra joined devices - Microsoft Entra ID | Microsoft Learn

-Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.

-Browse to Entra ID > Devices > All devices > Device settings.

-Select Manage Additional local administrators on all Microsoft Entra joined devices.

-Select Add assignments then choose the other administrators you want to add and select Add.

Please note that this option requires a Microsoft Entra ID P1 or P2 license. Changes may not take effect immediately and require the user to sign out and sign in again.

You can also refer to the AI-generated answer below for more information.

Answer 2

Global Administrator in Microsoft 365 or Microsoft Entra does not automatically give local administrator rights on a Windows PC. That is why the Office install is prompting for elevation.

For Office installation, the PC must have a local administrator available. If the signed-in account is not a local admin, when User Account Control appears, an account that already has administrator rights on that computer must enter its credentials.

Supported ways to grant local admin on a Microsoft Entra joined device are:

Manually elevate the user on that specific device
- This requires an account that is already a member of the local Administrators group on that PC.
- On Windows 10 1709 and later:
  - Go to Settings > Accounts > Other users
  - Select Add a work or school user
  - Enter the user principal name
  - Set Account type to Administrator
Use the command line on the device
- This also requires existing local admin rights.
- For Microsoft Entra ID users:
  - net localgroup administrators /add "AzureAD\<UserUPN>"
- For synced on-premises AD users:
  - net localgroup administrators /add "<domain>\<username>"
If no account on the PC already has local admin rights
- The Office install cannot be elevated by Entra or Microsoft 365 role assignment alone.
- A local admin must be provided on the device, or the device must be reprovisioned so an administrator is available during setup.

To verify whether the current Windows account is already an administrator:

Open Control Panel
Go to User Accounts > Change your account type
Confirm whether Administrator is selected

If the device is joined to a domain, use:

Control Panel > User Accounts > Change your account type > Properties > Group Membership
Confirm whether Administrator is selected

For the specific issue described, the missing setting is not in the Microsoft 365 admin center role assignment itself. The required change is membership in the local Administrators group on the PC.