Co-managed devices that are Domain Joined (Hybrid devices) can have Remote Desktop Users added to the local Remote Desktop Users group using the following instructions.  A technician may do this for a user when the user needs to create a Remote Desktop connection to their device.

Co-Managed Devices that are Domain Joined (Hybrid devices) can have Local Administrator accounts added to the Administrators group using the follow instructions. A technician may do this for a user and device that have been approved to be a local administrator on their device.

This article explains a workaround for situations where removal of Local Admin access causes a work stop situation.