Admin Rights, Elevated Access, ADD

I had a laptop that started off as a local Admin Account. I assigned +Work account using the Join using Active Directory Domain for the first employee. Then the employee left and to add a new employee I simply went to Other in login page and typed new credentials without making a new account via traditional way. Everything seems good. Two months later I realize that user does not have admin rights to install new applications. Local account info is lost. 

I can have the laptop shipped out to me to wipe and start fresh with a new account, but there's got to be a better way... Any CMD scripts that can grant the domain user Admin rights over the device? or any settings in Azure AD portal to control the device and allow Admin Rights to the active user?

And for future devices, When a user leaves our tenant, I expect the device to give the next user admin rights as well.