See https://docs.azure.cn/en-us/entra/identity/devices/assign-local-admin. Microsoft mentions the following in regards to the ‘Manage Additional local administrators on all Microsoft Entra joined devices’ option within Device Settings:

Microsoft Entra groups deployed to a device with this policy don’t apply to remote desktop connections. To control remote desktop permissions for Microsoft Entra joined devices, you need to add the individual user’s SID to the appropriate group.

I was able to add the group to the local group, but in practice, that doesn’t work.
I created a local group, added the Azure group as member of that, and added the local group with an ACL into a folder test. The members of the Azure groups doesn’t have access to it.

Does it need to be installed any kind of client on Windows to allow it to get the SIDs from Azure?

Were you able finally to use AAD Group in Remote Desktop Users group ?
Or it never worked out ?

I had several issues with this approach and prefer performing through script or proactive remediation tasks instead as have more control.

$aadObjectID = “939e62da-dc86-4da7-af38-bc31feedc046” # AAD Group Object ID to assign

function Convert-AzureADObjectIDToSID(){
param([string]$objectid)
$bytes = [Guid]::Parse($objectid).ToByteArray()
$array = New-Object ‘UInt32[]’ 4
[Buffer]::BlockCopy($bytes, 0, $array,0,16)
$sid = “S-1-12-1-$array”.replace(” “, “-“)
return $sid
}

$group = [ADSI]”WinNT://./Administrators,group”
$SID = Convert-AzureADObjectIDToSID -objectid $aadObjectID
$ismember = “False”
@($group.Invoke(“Members”)) | ForEach-Object {
If ($SID -match $_.GetType.Invoke().InvokeMember(“Name”, ‘GetProperty’, $null, $_, $null)) {
$ismember = “True”
}
}
If ($ismember -ne “True”) {
$result = $group.Add(“AzureAD://$SID,group”)
}

If I add my user account to the Remote Desktop Users group then I can use RDP.

Starting Windows 10 2004 it does work for groups.
But the recommended setting to use from Windows 10 20H2 and later is LocalUsersAndGroups
https://inthecloud247.com/manage-local-users-and-groups-with-microsoft-intune/

When I use same policy to add AzureAD users to ‘Remote Desktop users’ group in 1909, it works correctly.
Policy does work in 1909, but only for AzureAD users and not for AzureAD group.

Is there a way to get policy worked for AzureAD group in 1909 version? Our environment has dependency for 1909 that prevent us upgrading to 2004 version.

Donovan, have a look at the settings described in this article https://inthecloud247.com/manage-local-users-and-groups-with-microsoft-intune/. You can define a group action, in your case use Update.

Regards,

Peter