I currently reset new Windows machines, sign in during Entra setup with a shared install account, install our RMM agent, and then deploy Intune through the RMM. When the device is handed to its new owner, they sign in with their own Entra account, but Intune continues to show the shared enrollment account as the Primary User.
Is there a supported or practical way to automatically update the Intune Primary User UPN after the real user signs in? Ideally, I would like to detect the new user and make the change without manually editing each device. We have about 64 Windows devices, Microsoft 365 Business Premium, and I currently manage the environment by myself.
I realize Autopilot or pre-provisioning would probably be a cleaner approach, but this hands-on process lets me verify each machine before giving it to someone, and I am gradually improving an environment I inherited.
4 Answers
You can change the Primary User manually from the device properties in Intune, but that does not solve the scale problem. A scheduled PowerShell job or RMM script could query the device and owner data, then call Graph to update the assignment for all devices enrolled with the shared account.
There are PowerShell scripts available that change an Intune Primary User through Graph. They can work well when targeted at a device group, but test carefully if your devices are placed in nested groups, because some scripts do not automatically process nested membership.
The cleanest long-term fix is to stop enrolling devices with a shared account and use Autopilot or pre-provisioning so the intended user is associated during setup. If you need to keep the current workflow for now, automate the correction with Microsoft Graph. Your RMM can identify the last interactive Entra user, compare that account with the device owner in your asset system, and update the Intune primary user when they differ.
Using the asset database as the source of truth is usually safer than relying only on the last logged-on account, especially if technicians or temporary users may sign in first.
That makes sense. I am still learning the inherited setup, so I am trying to understand each part before replacing it with a more automated process.
Another option is to have the intended user authenticate during OOBE with a Temporary Access Pass, then run your setup script under that user’s enrollment. Be careful to remove any temporary local administrator permissions afterward. This avoids creating the wrong primary-user association, although Autopilot remains the more scalable solution.
I have seen the manual option, but I am specifically looking for a way to automate it across the fleet.