https://conditionalaccess.uk/using-intune-to-remove-local-admins/