Your Microsoft Entra tenant contoso.com contains a group named Contoso Help Desk. You need Contoso Help Desk to be added to the local Administrators group whenever a Windows device is joined to contoso.com. What should you do?

The Microsoft Entra Joined Device Local Administrator role grants members local administrator rights on all Windows devices that are Microsoft Entra joined. This directly addresses the requirement to add Contoso Help Desk to the local Administrators group on joined devices. Assigning the Cloud Device Administrator role is incorrect because this role manages device objects in Microsoft Entra ID, not local administrator access on the devices themselves. Configuring Enterprise State Roaming settings is irrelevant as it synchronizes user settings across devices, not local administrator group membership. Enabling Microsoft Entra Local Administrator Password Solution (LAPS) is for managing local administrator account passwords, not for assigning groups to the local Administrators group during device join.