Find the primary user of an Intune device

Artikkeli
10/30/2023

Primary user, also known as User Device Affinity, is a property of each Intune device. An Intune device can have zero or one primary user assigned to it. When there's no primary user assigned, the device is referred to as a "Shared Device".

Find a device's primary user

Sign in to the Microsoft Intune admin center.
Choose Devices > choose a device.
On the Overview page, you can see the primary user listed.

Change a device's primary user

For Windows 10 devices that are Microsoft Entra joined or Microsoft Entra hybrid joined, the primary user of a device can be updated.

Sign in to the Microsoft Intune admin center.
Choose Devices > All devices > choose a Windows device > Properties > Change primary user.
Select a new user and choose Select.

After the primary user is updated, it will also be updated in Intune and Microsoft Entra device blades.

Note

Supported on Windows devices only. Enrollment is required to assign a new primary user on iOS and Android devices.
Supported on Microsoft Entra joined and Microsoft Entra hybrid joined devices only. Not supported on devices that are Microsoft Entra registered only.
To be assigned as the Primary user, the user must be licensed for Intune.
Updates to the primary user across Intune and Microsoft Entra ID can take up to 10 minutes to be reflected.
Changing the primary user of the device does not make any changes to local group membership such as adding or removing users from the "Administrators" local group.
Changing the primary user does not change the "Enrolled by" user in Intune.
To change or remove the Primary user of a device requires the permission Managed devices/Set primary user.

What is the primary user?

The primary user property is used to map a licensed Intune user to their devices in:

The Company Portal app
End-user website
IT pro experiences, like troubleshooting pages in the Azure portal. These pages map user accounts to devices by using the primary user.

Company Portal app

The Company Portal app expects that the user account that signed in to the Company Portal is the primary user of that device. If another user has been assigned as the primary user, the Company Portal shows a warning:

"This device is already assigned to someone in your organization. Contact company support about becoming the primary device user. You can continue to use Company Portal but functionality will be limited."

If an Intune device has no primary user assigned, then the Company Portal app detects it as a shared device. Shared devices are visually identifiable with a "shared" label appearing on the device tile. In this mode, the Company Portal can still be used to request and install available apps. However, self-service actions (reset/rename/retire) aren't available.

To appear in the Company Portal on shared devices, available apps must be assigned to a user group. They'll be installed in the system context or user context, depending on how the app was configured by the IT administrator. For more information about app context, see Installing apps on Windows 10 devices. Company Portal version 10.3.4651.0 or later is required to use this feature.

Who is assigned as the primary user?

Intune automatically adds primary user to devices during or soon after enrollment. The enrollment method determines when the primary user is added to a device.

Platform	Enrollment method	Primary user assigned	Primary user is assigned
Windows	Add work or school (user driven)	Enrolling user	During enrollment
Windows	Modern App sign-in (user driven)	Enrolling user	During enrollment
Windows	Enroll in MDM only (user driven)	Enrolling user	During enrollment
Windows	Microsoft Entra join (out of box experience)	Enrolling user	During enrollment
Windows	Microsoft Entra join (Autopilot out of box experience)	Enrolling user	During enrollment
Windows	Enroll in MDM only	Enrolling user	During enrollment
Windows	Hybrid AADJ + automatic enrollment GPO	First user to sign in to Windows	When first user signs in to Windows
Windows	Co-management	First user to sign in to Windows	When first user signs in to Windows
Windows	Microsoft Entra join (bulk enrollment token)	None	Not applicable
Windows	Microsoft Entra join (Autopilot self-deploying mode)	None	Not applicable
Cross-platform	User driven enrollment with Company Portal App	Enrolling user	During enrollment
Cross-platform	Device Enrollment Manager (DEM)	Enrolling DEM user	During enrollment
iOS/iPadOS, macOS	Apple Automated Device Enrollment (DEP with User Affinity	Enrolling user	During enrollment
iOS/iPadOS, macOS	Apple Automated Device Enrollment (DEP without User Affinity)	None	Not applicable
Android	Android Corporate-Owned, Dedicated devices	None	Not applicable

Primary user and Microsoft Entra device owner

In some cases, the Intune primary user may be different from the Microsoft Entra Device's Owner property (viewable under Devices > Microsoft Entra Devices). The Microsoft Entra Device owner is added during a device's registration into Microsoft Entra ID.

For newly-enrolled Microsoft Entra devices, the Microsoft Entra ID Owner property is automatically set at the same time that the Intune primary user is set.

Next steps

Manage your Intune devices.