How to give standard users Local Admin rights only on a specific group of entra joined devices

Yes. Use Microsoft Entra groups with the Local Users and Groups MDM policy, targeted only to the device group that should allow local admin access.

Recommended approach:

1. Create a Microsoft Entra security group for the users who should become local admins.
2. Create a separate device group containing only the Microsoft Entra joined devices that should allow this access.
3. In Intune, deploy a Local Users and Groups policy to that device group.
4. Configure the policy to add the user group to the local Administrators group on those devices.

Important details:

• This method provides the device-level granularity needed for only a subset of Microsoft Entra joined devices.
• The tenant-wide Microsoft Entra Joined Device Local Administrator role is not suitable for this scenario because it applies to all Microsoft Entra joined devices and can’t be scoped to a specific device set.
• This group-based local admin management applies only to Microsoft Entra joined devices, not Microsoft Entra hybrid joined or Microsoft Entra registered devices.
• To add Microsoft Entra groups through this policy, the group SID is required. The SID is the securityIdentifier value from Microsoft Graph for the group.
• Administrator-rights evaluation supports up to 20 groups for a user/device sign-in. Keeping group membership within that limit helps ensure rights are assigned correctly.
• This policy does not apply Microsoft Entra groups to remote desktop connections. For RDP permissions, the individual user SID must be added to the appropriate local group.

If the goal is to prevent users who join devices from automatically becoming local admins, also review the Registering user is added as local administrator on the device during Microsoft Entra join setting, or use Windows Autopilot with the user account type set to standard.

• How to manage the local administrators group on Microsoft Entra joined devices
• How to manage the local administrators group on Microsoft Entra joined devices
• Manage device identities using the Microsoft Entra admin center