I currently provision Windows devices through a scripted RMM deployment that runs under a shared install account. The device is reset, signed in to Entra ID with that enrollment account, and then the RMM installs Intune. After handing the device to an employee, they sign in with their own Entra ID account, but Intune continues to show the enrollment account as the Primary User.
Is there a supported way to automatically update the Intune Primary User to the employee who receives the device? My current process is:
1. Reset the new machine.
2. Sign in to Entra ID using the shared enrollment account.
3. Install the RMM and Intune through the RMM.
4. Give the device to the employee.
5. Have the employee sign in with their own account.
I realize Windows Autopilot or pre-provisioning would probably be a better long-term approach, but I inherited this setup and currently prefer to verify each machine before handing it over. We have about 64 Windows devices, Microsoft 365 Business Premium, and I manage the environment alone.
3 Answers
If you need to keep the current workflow, automate the correction. Use your RMM or asset-management system to determine the assigned employee, then run a script or Graph API call to compare that user with the device's Intune Primary User and update it when they differ. Your asset database should ideally be the source of truth rather than simply relying on the last interactive logon.
The cleanest fix is to stop enrolling devices with a shared account and use Windows Autopilot pre-provisioning instead. That lets you prepare and validate the device while keeping the eventual user assignment separate from the technician or enrollment account.
That is the direction I want to move toward. I inherited a messy environment and am learning how everything works before automating more of the process.
You can change the Primary User from the device's properties in Intune, but that is only a manual fix. For a larger fleet, use a scheduled script with the Microsoft Graph permissions needed to update the managed device, and scope it to the relevant device group. Another option is to have the intended user sign in during initial setup with a Temporary Access Pass, while ensuring the provisioning script removes unnecessary local administrator access afterward.
I would prefer to automate it rather than manually edit each device in the Intune portal. Checking the assigned owner in the asset system sounds more reliable.