Update Intune Primary User with PowerShell or Azure Automation

by ·

Not all companies have implemented Autopilot. So, we still see a lot of customers running WDS or SCCM to reimage computers with company golden image. When preparing windows and logging in to the machine to do installs and customizations, it will automatically Hybrid Join the Azure Active Directory. And oops, it did so with the installer account. After that join it usually is configured to pop up in Intune so we can manage it. Intune has a Primary User assigned to each device. And guess who´s the Primary User! The installer account.

What is Primary User and why is that important.

The Primary User property in Intune is used when:

  • Map a licensed Intune user to the device
  • Show and map the user to the device in that users Company Portal app
  • Show and map the user to the device in that users Device management website
  • Easier to map user to device in Endpoint manager and Azure portal

If primary user is another user, this will happen:

  • Company Portal shows a warning “This device is already assigned to someone in your organization…
  • If an Intune device has no primary user assigned, then the Company Portal app detects it as a shared device
  • Company Portal is limited in functions. It can be published apps missing and device management tools missing.

How to change the Primary Use in Intune

It is easy to change the Primary User on an Intune Device.

  1. Open Intune Portal
  2. Select Devices / Windows
  3. Select the Device you want to change
  4. Select Properties
  5. Click Change Primary User button
  6. Serach for and add the new user
  7. Click Save

Change Primary User with PowerShell or Azure Automation

But when you have lots of devices installed and enrolled with the install account. you might need to change them all. So, I built a script for this.

The script uses Graph and using the Microsoft MgGraph module.

First it collects all Devices in Intune that are “Windows” devices

Second it collects all sign in logs where the “application” is “Windows Sign In”

Then it loops and processes every device and:

  1. Sign in logs are used to determine who has logged on to the device the most times in the last 30 days
  2. Device object are used to get the Primary User of the device
  3. If they don’t match, it will change the Primary User to the user that has logged the most times in the last 30 days.

Not so complicated!

Run the script in PowerShell

If you want to run this script manually in PowerShell

  1. Download the script Intune-Set-PrimaryUsers.ps1 from my Github
  2. Modify the setting: “$AzureAutomation= $False”
    You can also enable Test mode so no changes are made with $ExecutionMode = “Test”
  3. Modify the other settings in the Modifiable Parameters and defaults section
  4. Run the script in PowerShell

When running the first time you need to consent permissions that will be assigned to your account.

When running you will have a few host outputs on the progress:

Run the script in Azure Automation

Azure Automation is a fantastic tool to use to schedule automations in your organization.

  1. Open Azure Portal
  2. Create a new Azure Automation Account
  1. Select System assigned managed identity
  1. And you can keep the Public network access
  1. When the account is ready, open it up
  2. Select Modules node and click Add Module
  1. Add these modules from Gallery in Runtime Version 5.1:
  • Microsoft.Graph.Authentication
  • Microsoft.Graph.DeviceManagement
  • Microsoft.Graph.Reports
  1. Select Runbooks node and click Create a Runbook
  1. Give the runbook a suitable name and select PowerShell with runtime version 5.1
  1. Copy the script Intune-Set-PrimaryUsers.ps1 from my Github and paste it in your Runbook.
  2. Modify it to suit your environment
  3. The last thing missing is permissions for your Managed Account. This needs to be added manually with a PowerScript.
  4. Download the script Azure-Add-PermissionsManagedIdentity.ps1 from my Github
  5. Change the two lines to fit your environment.
$TenantID = "11111-08a2-4ade-9a68-0db7586d80ad"
$ManagedIdentity = "Tbone-Automate"
  1. Run the script in PowerShell
  1. Go back to your automation account
  2. Open your RunBook
  3. Click Edit
  4. Chage the setting $ExecutionMode = “Test” to run in Test mode and no real changes are made
  5. Now you can click Test Pane
  6. And run the script to see the results.
  7. If it works as expected, change back $ExecutionMode = “Prod”
  8. Publish the script and schedule the script to run every day.

Script can be found here Intune-Set-PrimaryUsers.ps1 on my Github

About The Author

Mr T-Bone

Torbjörn Tbone Granheden is a Solution Architect for Modern Workplace at Coligo AB.
Most Valuable Professional (MVP) on Enterprise Mobility. Certified in most Microsoft technologies and over 23 years as Microsoft Certified Trainer (MCT)

See author's posts

Tags:

Mr T-Bone

Torbjörn Tbone Granheden is a Solution Architect for Modern Workplace at Coligo AB. Most Valuable Professional (MVP) on Enterprise Mobility. Certified in most Microsoft technologies and over 23 years as Microsoft Certified Trainer (MCT)

You may also like...