az-104 Practice Question 698
Exam: az-104
Domain: Manage Azure identities and governance
Topic: Describe Azure identity, access, and security
Difficulty: medium
You sign up for Azure Active Directory (Azure AD) Premium P2.\nYou need to add a user named admin1@contoso.com as an administrator on all the computers that will be joined to the Azure AD domain.\nWhat should you configure in Azure AD?
Answer Options
A
Device settings from the Devices blade
B
Providers from the MFA Server blade
C
User settings from the Users blade
D
General settings from the Groups blade
Correct Answer
A: Device settings from the Devices blade
Explanation
The correct answer is A: Device settings from the Devices blade.
Detailed Explanation:
When a Windows computer is joined to Microsoft Entra ID (formerly Azure AD), Microsoft Entra adds the following security principals to the local Administrators group on the device:
1. The Microsoft Entra Global Administrator role
2. The Microsoft Entra Device Administrator role
3. The specific user performing the Microsoft Entra join
To grant a designated user (admin1@contoso.com) administrative rights across all Microsoft Entra joined computers without making them a tenant-wide Global Administrator, you configure the "Additional local administrators on Microsoft Entra joined devices" setting.
Portal Path:
1. Sign in to the Microsoft Entra admin center or Azure portal.
2. Navigate to Microsoft Entra ID > Devices.
3. Select Device settings.
4. Under "Additional local administrators on Microsoft Entra joined devices", select "Manage Additional local administrators" and add the user.
• Why B is incorrect: MFA Server provider settings configure multi-factor authentication server infrastructure, not local workstation administrative groups.
• Why C is incorrect: User settings configure user-level directory options (such as access to the Azure portal and LinkedIn integrations), not device administrative privileges.
• Why D is incorrect: Group settings manage security and Microsoft 365 group creation policies, not local device administrators.
Official Reference:
Microsoft Learn: How to manage local administrators on Microsoft Entra joined devices
https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin
Verification Date: October 2026.