Microsoft Endpoint Administrator — Question 87

You have an Azure AD tenant named contoso.com.

You need to ensure that users are not added automatically to the local Administrators group when they join their Windows 11 device to contoso.com.

What should you configure?

Answer options

• A. Windows Autopilot
• B. provisioning packages for Windows
• C. Security defaults in Azure AD
• D. Device settings in Azure AD

Correct answer: D

Explanation

The correct answer is D, as configuring Device settings in Azure AD allows you to manage how devices join the organization and control local group memberships. Options A and B relate to device provisioning methods, which do not directly address the automatic addition to the Administrators group. Option C pertains to security settings rather than device management specifics.