Best Practice for Local Admin Rights on Autopilot Devices

Hello everyone, we have around 400 devices in our company, a mix of hybrid devices and Autopilot devices. The Autopilot devices are mainly used by field staff, such as installers and service technicians. These users require elevated permissions for setup installations and for changing network settings, specifically IP addresses.

For this purpose, I configured the following setting under Endpoint Security → Account Protection:

• User selection type: User/Group
• Group and user action: Add (Update)
• Local group: Administrators

(And of course, I created and assigned a dedicated group for these users.)

My question is: is our approach correct? Because in our environment, I assume that LAPS cannot really be used effectively.

Also, how does the security aspect look in such a scenario? What would be considered best practice for balancing operational requirements and security?