Manage the Local Administrators Group on Azure AD Joined Devices

• If your tenant users are synchronized from on-premises Active Directory, use net localgroup administrators /add "Contoso\username".
• If your tenant users are created in Azure AD, use net localgroup administrators /add "AzureAD\UserUpn"

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/devices/assign-local-admin

Local Administrator Password Solution - LAPS

Microsoft provide a free local administrator password management tool, to enable centralised management of randomised local administrator passwords, mitigating

the risk of lateral escalation that results when customers have the same administrative local account and password combination on many computers.

The tool is available here:
https://technet.microsoft.com/en-us/mt227395.aspx