In order to prevent future enrolled devices from automatically adding the enrolling user to the local administrators group, navigate to the Device Settings section of Microsoft Entra & change the below setting to “None”. It is advised to leave the Global Administrators set to “Yes” to serve as a backup method for providing administrative log in to a managed device, if necessary, with LAPS serving as your primary method for administrative access.