Read this post for more information on primary user in Intune. 

By Scott Duffey | Intune Sr. PM

If you’ve worked with System Center Configuration Manager in the past, you’ll be familiar with the term “User Device Affinity”. In Intune we call this “Primary User” and it’s simply a mapping between an Intune device and a user. A device can have just one Primary User, but a User can have more than one device.

The point of having this relationship is to improve experiences for both end users and IT support. Here’s a few examples where this mapping is useful:

\n
• When a user opens the Company Portal app on their phone, they see a list of all their Intune-managed devices. In case they have an Intune-managed device that is lost or stolen, they can perform a reset for that device. This self-service reduces IT support cases as the end user can take care of the problem themselves. The list of all Intune managed devices is built from the Primary User relationship.
\n
• Another example is on the IT support side. When an IT admin uses the troubleshooting page in the admin portal, the first step is to supply a username. This name then enumerates all the user’s devices (along with policies, apps and other useful information). Again, this device list is built based on Primary User.
\n

As an Intune IT admin, you can view the Primary User of a device by going to the device overview page in the admin portal.

What happens when the device doesn’t belong to anyone?
While most of the devices being managed by Intune today are single-user devices, there are some customer scenarios where this isn’t the case. For example, you might have Kiosks, First-line worker devices or Windows 10 PC’s being used by multiple users in a classroom or call center. We call those shared devices. These devices typically have a different set of end-users and self-service based requirements in the Company Portal.

Moving forward, and based on many customer requests, you’ll start to see improvements in the shared device scenario.

\n
• In an upcoming release of the Company Portal app for Windows (we're planning on a release shortly), shared devices (ones without any primary user assigned) will now be able to be used for each Intune user who signs into Windows and opens the app. Each user will be able to install Available apps that have been assigned to their user account. There is also a label to help identify a shared device vs a single user device and importantly, end-users won’t be allowed to perform any device actions (like removing it from management or factory resetting it) via the Company Portal app.
\n
• In future releases, we’ll be building out some additional changes that customers have been asking for including the ability to add or change a primary user through the admin portal, or seamlessly inherit Primary User from other sources (such a SCCM).
\n

For more detailed information on how to configure and use the Intune Primary User, we’ve posted updates to the documentation page here: https://aka.ms/primary_user_intune.

Blog Post Updates:

\n
• 3/10/20 - With an update that the Change the Intune Primary User – Public Preview is starting to roll out to customers globally under preview. You should see the feature within the next few weeks. More information can be found in our What's new document of Week of March 9, 2020 here and from Scott Duffey's post here: Change the Intune Primary User – Public Preview Now Available.
\n

By Scott Duffey | Intune Sr. PM

If you’ve worked with System Center Configuration Manager in the past, you’ll be familiar with the term “User Device Affinity”. In Intune we call this “Primary User” and it’s simply a mapping between an Intune device and a user. A device can have just one Primary User, but a User can have more than one device.

The point of having this relationship is to improve experiences for both end users and IT support. Here’s a few examples where this mapping is useful:

\n
• When a user opens the Company Portal app on their phone, they see a list of all their Intune-managed devices. In case they have an Intune-managed device that is lost or stolen, they can perform a reset for that device. This self-service reduces IT support cases as the end user can take care of the problem themselves. The list of all Intune managed devices is built from the Primary User relationship.
\n
• Another example is on the IT support side. When an IT admin uses the troubleshooting page in the admin portal, the first step is to supply a username. This name then enumerates all the user’s devices (along with policies, apps and other useful information). Again, this device list is built based on Primary User.
\n

As an Intune IT admin, you can view the Primary User of a device by going to the device overview page in the admin portal.

What happens when the device doesn’t belong to anyone?
While most of the devices being managed by Intune today are single-user devices, there are some customer scenarios where this isn’t the case. For example, you might have Kiosks, First-line worker devices or Windows 10 PC’s being used by multiple users in a classroom or call center. We call those shared devices. These devices typically have a different set of end-users and self-service based requirements in the Company Portal.

Moving forward, and based on many customer requests, you’ll start to see improvements in the shared device scenario.

\n
• In an upcoming release of the Company Portal app for Windows (we're planning on a release shortly), shared devices (ones without any primary user assigned) will now be able to be used for each Intune user who signs into Windows and opens the app. Each user will be able to install Available apps that have been assigned to their user account. There is also a label to help identify a shared device vs a single user device and importantly, end-users won’t be allowed to perform any device actions (like removing it from management or factory resetting it) via the Company Portal app.
\n
• In future releases, we’ll be building out some additional changes that customers have been asking for including the ability to add or change a primary user through the admin portal, or seamlessly inherit Primary User from other sources (such a SCCM).
\n

For more detailed information on how to configure and use the Intune Primary User, we’ve posted updates to the documentation page here: https://aka.ms/primary_user_intune.

Blog Post Updates:

\n
• 3/10/20 - With an update that the Change the Intune Primary User – Public Preview is starting to roll out to customers globally under preview. You should see the feature within the next few weeks. More information can be found in our What's new document of Week of March 9, 2020 here and from Scott Duffey's post here: Change the Intune Primary User – Public Preview Now Available.
\n

Read this post for more information on primary user in Intune. 

What will the impacts if nonprimary use login into devices.

01.does it affect application deployment.

02.does it affect device configuration deployment.

03.does it affect Baseline configuration deployment.

04.does it affect Script deployment.

** If targeting device groups.

** If targeting users groups.

Create dynamic device groups according to primary users security/distribution/(what ever type) group.

Please...

Hi,

Any time frame for this:

\"seamlessly inherit Primary User from other sources (such a SCCM).\"

Thanks

Please make installing apps via Corporate portal possible for all users even if primary user is set!!!

It is nice that you gave the ability for admins to sit all day and click one at a time to remove the primary users off of our shared devices leaving little time for our actual work!

We need to be able to flag devices so that they remain a shared device and a primary user CANNOT be assigned.  If not that then we need to be able to bulk select and remove the primary user from Endpoint manager.

Our computer technicians who manage our devices, onsite and remotely, do most of the imaging are being set as the primary user messing up the shared devices for others when they use them.

It is not feasable to manually check and remove our technician accounts from the Primary User field each day.

Hi SS0123, AlexSamadYB, AlviC1440, DonaldSteele, Ravisrinivasamurthy, Mark Burland - We're excited to announce that today we started rolling out a feature giving you the ability to change a device’s primary user. More information can be found in our What's new document of Week of March 9, 2020 here and from Scott Duffey's post here: Change the Intune Primary User – Public Preview Now Available. Thank you all for your patience!

PeterHoldridge, we've made some improvements to Microsoft Endpoint Manager in the past few months, and would be happy to take additional feedback to the team to address your concerns. Could you private message us with current blockers for us to follow-up on?

\"In future releases, we’ll be building out some additional changes that customers have been asking for including the ability to add or change a primary user through the admin portal, or seamlessly inherit Primary User from other sources (such a SCCM).\"

This is basically essential. We are an AD / SCCM environment moving towards HybridAD and Intune. Crucially, most of our devices are shared use (classrooms). At present, Microsoft's advice seems very 2005. It's regressive to go from zero-touch deployment in SCCM to heavy touch to ensure the device enrolls without being linked to the first user to use the device.

Auto-enrollment via SCCM or AD is completely pointless if you can't specify that the device is to be a shared device.

Hi Intune_Support_Team 

We are having a similar scenario as explained above - where the primary user (also device enrolled user) would not be using the device, instead another Azure AD user (who is not the primary user of the device) will be using the device in KIOSK mode.  We are unable to control the device through Intune (e.g simple scenario like restart via Intune is not working). Looking forward to get some some workaround / fix on this regard at the earliest

Just wanted to ask for an update on the primary user change ability from the Azure Portal. It has been almost 6 months since this was referenced in the initial thread post, and creates significant extra work for IT.

Intune_Support_Team thanks for the broken links!

Intune_Support_Team why are you leaving Hybrid Azure AD scenarios out of the mix? How do you expect to transition people to the cloud when you roll out things that don't work for existing AD infrastructure?

Intune_Support_Team Why does it take years to get changes implemented that should have been incorporated when it was deployed? Why do you make your customers unenroll a device in order to change the primary user? Who's idea was this and why did you think this was a good idea? Changing the primary user by an admin should have been the way to go from the very beginning. Do you know how many things have to be in place for enrolling another user? When you unenroll, it also disjoins from Hybrid Azure AD! This makes it especially difficult if they are remote and have to be on a VPN and require MFA.... You leave your Hybrid customers in the dust all the time Intune_Support_Team ....

Par for the course by Microsoft though...