This week’s Windows 365 What’s New update is a small change with real operational weight. The Enable local admin setting is now available in public preview in Cloud PC configurations (Week of September 7, 2026), giving administrators a modern Intune path to control which users are local administrators on their own Cloud PCs.

On its face it is a single toggle moving into a new blade. In practice it closes the last meaningful gap left by Microsoft’s retirement of the User Settings page — the one place where admins could previously grant local admin rights. If you have been waiting on a Cloud PC Settings replacement so you can finish your User Settings migration, this is it.

What Changed

The announcement on the What’s new in Windows 365 Enterprise page reads:

Enable local admin setting in Cloud PC configurations now in Public Preview — The existing Enable local admin setting can now be configured through Devices > Cloud PC Settings > Create > Cloud PC configurations in Intune. This setting allows IT admins to grant users local administrator permissions on their Cloud PCs.

Full configuration guidance lives on the updated Cloud PC configurations page.

What Enable Local Admin Actually Does

The setting itself is unchanged from the old User Settings version: if enabled, each user in the assigned groups is elevated to a local administrator of each of their own Cloud PCs. The permissions apply at the user level, and only to the Cloud PC assigned to that user.

That means the targeted user’s Entra ID account is added to the local Administrators group on their own Cloud PC, letting them:

  • Install and uninstall software and drivers
  • Change system and application settings
  • Manage local users and groups
  • Modify security-relevant configuration, including the firewall and services

This is not tenant-level admin or a Windows 365 admin role — it is the classic permanent local admin on a persistent Windows desktop. For developer and power-user scenarios that is often a productivity requirement. For regulated or shared workloads it is usually a hard no.

Why the move matters: User Settings is being retired

Microsoft has been consolidating Cloud PC controls into a new Cloud PC configurations construct under Devices > Cloud PC Settings, and phasing out the older User Settings page. The tricky part of that migration was local admin: unlike restore and reset options, Enable local admin had no direct replacement in the new model — admins doing the migration hit a wall when they got to this one setting.

This preview removes that wall. Microsoft’s updated documentation is explicit about the recommendation:

We recommend using Cloud PC configurations when configuring the Enable local admin (preview) setting. Existing configurations of Enable local admin (preview) in User Settings can continue to be managed there for now. Over time, we recommend moving these configurations to Cloud PC configurations as support through User Settings is phased out.

So nothing breaks today. Existing User Settings assignments keep working. But the forward path is now clear, and it is the same path the rest of your Cloud PC settings are already on.

How to Configure It

  1. Sign in to the Microsoft Intune admin center.
  2. Go to Devices > Cloud PC Settings (under Manage Windows 365 Cloud PCs).
  3. Select Create > Cloud PC configurations.
  4. Give the setting a Name and an optional Description.
  5. On the Configuration settings tab, set Enable local admin (preview) to Enable. Leave anything you do not want to configure as Not configured.
  6. Add any Scope tags you need.
  7. Under Assignments, choose Add Groups and select the user groups that should receive the setting.
  8. Review and select Create.

Cloud PC configurations support user group targeting, and the same page also hosts two other capabilities: AI-enabled features (Frontier preview) and Business continuity and disaster recovery features (preview). Microsoft’s documentation also carries a note that certain settings on this page apply only to Cloud PCs sized 8 vCPU / 32 GB / 256 GB and higher, so check the sizing note before you roll something out broadly.

Watch for overlapping assignments

Local admin behavior is driven by user group membership, so overlapping policies are the classic source of surprise. Under the User Settings model, if a user belonged to more than one policy, the most-recently-created policy won and the others were ignored — the last updated time did not matter.

The sharper edge: if Enable local admin is not checked in the applicable setting, local admin rights are removed from users in those groups. That can quietly undo custom solutions or scripts that add users to the local Administrators group. Keep your assignments unambiguous and avoid targeting the same group from multiple configuration objects.

Security Considerations

Granting end users local admin on a persistent Windows desktop is a genuine risk, not a formality. Local admin users can install arbitrary software, disable or weaken security controls, run malware with elevated privileges, and tamper with logging and security agents. Cloud PCs are no different from physical PCs here — and they are remotely reachable, which widens the exposure.

Practical guidance when you enable it:

  1. Default to off for standard users and regulated workloads. Turn it on only where job function requires it — developer tooling, specific drivers, or debugger scenarios — and scope it to a small, well-understood Entra ID group.
  2. Use Windows LAPS. When a local admin account must exist (break-glass, support), manage it with Windows LAPS through Intune Endpoint security > Account protection so passwords are unique, rotated, and stored securely.
  3. Prefer just-in-time elevation. Where you can, adopt Endpoint Privilege Management so elevation is time-bound, approved, and audited instead of permanent.
  4. Consider explicit local group membership. Intune Account Protection > Local user group membership gives finer control than a blanket group toggle when you need specific accounts in the local Administrators group.
  5. Use Intune and Windows 365 RBAC for administrative operations instead of logging in as local admin whenever the task allows.

What Admins Should Do Now

  1. Inventory your User Settings usage. Find any User Settings policy that currently enables local admin and note which user groups it targets.
  2. Stand up the equivalent Cloud PC configuration in preview, assign the same groups, and validate that local admin membership behaves as expected on a test Cloud PC.
  3. Recreate the setting, then retire the old one. Once Cloud PC configurations is working, remove the overlapping User Settings policy so there is a single source of truth — and remember the removal semantics for local admin.
  4. Tighten as you migrate. This migration is a good moment to shrink the local admin population rather than copy a broad group forward. Pair it with LAPS and, where possible, Endpoint Privilege Management.
  5. Confirm sizing. Review the note about 8 vCPU / 32 GB / 256 GB and higher for the settings on this page before wide deployment.

Sources

Follow along on X at https://x.com/kkaminsk for weekly Windows 365 and Intune updates.