A senior engineer’s guide to fixing Intune’s stubborn primary user assignment with PowerShell and architectural best practices, turning a common helpdesk headache into a manageable, automated process.

Wrestling the Hydra: Taming Intune’s Primary User and Handling Shared Devices

I remember a frantic call on a Monday morning. Our head of sales, let’s call him “Bob,” couldn’t access a critical app on his new laptop. The policy wasn’t applying. We checked everything—groups, filters, license—all green. After 30 minutes of pulling our hair out, we checked the device’s primary user in Intune. It wasn’t Bob. It was “temp-it-01,” a temporary account used by the service desk tech who imaged the machine. Intune had latched onto that first user and refused to let go, blocking Bob’s user-assigned policies. We’ve all been there. It’s one of those “simple” problems that can derail a morning and highlights a fundamental challenge in how Intune thinks about devices vs. how we actually use them.

The “Why”: Intune’s Sticky User Syndrome

Before we dive into the fixes, let’s understand the root of the problem. By design, Intune wants a device to have a single primary user. This identity is used for app deployments, policy targeting, Company Portal enrollment, and reporting. When a user enrolls a device (especially through Autopilot or Company Portal), Intune often permanently stamps them as the primary user. The problem is, our world isn’t always one-to-one. Laptops get re-assigned, new hires get hand-me-downs, and we have shared devices on manufacturing floors or in conference rooms. Intune’s default “sticky” behavior just doesn’t account for the operational reality of IT.

Solution 1: The Quick & Dirty (The GUI Fix)

This is your go-to when you have a single, panicked user on the phone and you just need to solve it now. It doesn’t scale, but it’s effective for one-off emergencies.

1. Navigate to the Microsoft Intune admin center.
2. Go to Devices > All devices and find the problematic device.
3. In the device’s Overview pane, you’ll see the current Primary user.
4. Click Change primary user. A new pane will open where you can search for and select the correct user.
5. You can also just click Remove primary user if the device should be treated as a shared machine with no specific owner.

This is fine for “Bob” from sales, but if you’re trying to clean up 50 devices after a departmental re-org, you’ll want to automate.

Solution 2: The Scalable Fix (The PowerShell Way)

When you need to fix this at scale, you break out PowerShell and the Microsoft Graph API. This is the real fix for sysadmins. First, make sure you have the necessary tools installed.

Install-Module Microsoft.Graph.Intune -Force
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.ReadWrite.All"

Pro Tip: Be warned! The DeviceManagementManagedDevices.ReadWrite.All permission is powerful. In a production environment, you should be using a service principal or managed identity with precisely scoped permissions, not running this interactively with your global admin account.

Now, let’s look at a practical script. The goal here is to find a device and either change the primary user or remove them entirely.

# --- Script to Manage Intune Primary User ---

# Variables
$deviceName = "LPT-FIN-1138" # The device you're targeting
$newPrimaryUserUPN = "sandra.c@techresolve.com" # The UPN of the correct primary user

# 1. Find the Intune Device Object
Write-Host "Searching for device: $deviceName"
$device = Get-IntuneManagedDevice -Filter "deviceName eq '$deviceName'"
if (-not $device) {
    Write-Error "Device '$deviceName' not found. Exiting."
    return
}

# 2. Find the new user's Azure AD Object to get their ID
Write-Host "Searching for user: $newPrimaryUserUPN"
$user = Get-MgUser -Filter "userPrincipalName eq '$newPrimaryUserUPN'"
if (-not $user) {
    Write-Error "User '$newPrimaryUserUPN' not found. Exiting."
    return
}

# 3. Perform the Update
Write-Host "Setting '$newPrimaryUserUPN' as primary user for '$deviceName'..."
Set-IntuneManagedDevice -managedDeviceId $device.managedDeviceId -userPrincipalName $user.UserPrincipalName

Write-Host "Update command sent successfully."

# --- To REMOVE the primary user instead ---
# Uncomment the line below and comment out the 'Set-IntuneManagedDevice' line above
# Remove-IntuneManagedDeviceUser -managedDeviceId $device.managedDeviceId

# Write-Host "Primary user removal command sent successfully for '$deviceName'."

You can easily wrap this logic in a loop, reading from a CSV file of device names and new user UPNs to perform this in bulk. This is how you turn a day of clicking in a GUI into a 5-minute script run.

Solution 3: The ‘Nuclear’ Option (The Architect’s Answer)

Sometimes, the problem isn’t the primary user; it’s the fact that you’re trying to assign one at all. If a device is truly shared—a conference room PC, a factory floor kiosk, a loaner laptop pool—then it shouldn’t have a primary user. Fighting this is a losing battle.

The real, permanent fix is to enroll these devices differently from the start.

Choosing the right enrollment and configuration strategy from the beginning is the ultimate fix. It moves you from being a reactive firefighter to a proactive architect, which is where we all want to be. So next time you see this issue, fix it with the script, but then ask the bigger question: “Should this device have had a primary user in the first place?”

Darian Vance

Lead Cloud Architect & DevOps Strategist

With over 12 years in system architecture and automation, Darian specializes in simplifying complex cloud infrastructures. An advocate for open-source solutions, he founded TechResolve to provide engineers with actionable, battle-tested troubleshooting guides and robust software alternatives.

🤖 Frequently Asked Questions