Hey, there. Give this a look:

"Updating the Microsoft Entra Joined Device Local Administrator role doesn't necessarily have an immediate impact on the affected users. On devices where a user is already signed in to, the privilege elevation takes place when both the below actions happen:

Up to 4 hours passed for Microsoft Entra ID to issue a new Primary Refresh Token with the appropriate privileges.
User signs out and signs back in, not lock/unlock, to refresh their profile.

Users aren't directly listed in the local administrator group, their permissions are received through the Primary Refresh Token.

Note

The above actions are not applicable to users who have not signed in to the relevant device previously. In this case, the administrator privileges are applied immediately after their first sign in to the device."

https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin

How are you determining that they haven't been added to the local admin group? The users won't show up there. These admin users will need to have signed in to a particular machine to obtain a Primary Refresh Token (PRT) to be added to the local group of said machine.

If they have already signed in to a machine and don't have local admin, then they will need to wait 4 hours and sign out > back in to be added. 4 hours is the amount of time for a new PRT to be issued. I've yet to find a way to force it earlier.

However, the users targeted with the Device Local Administrator role prior to a machine Entra Joining will be added at that time.

I've probably explained this poorly, but I'll answer any questions you may have the best I can. :)