Allow only user account that is assigned to the device

Question

How to restrict user account that has been assigned to the device in Intune?

I have setup the configuration profile and have entered everything but not sure what would go under

OMA-URI Value section?

What value will be for those users who have been assigned to that device and no one else should login with their credentials?

oryxway390 · Answer

Administrators AzureAD - ? We cannot be assigning this to each user account right? I am confused sorry if I am too dumb here.We are allowing only those users assigned to the device to logon to the laptop or desktop.For example I am John Doe and have been assigned the device DESKTOP-XY123and another user Jill Doe has been assigned the device LAPTOP-ABC321Now, we want only the users assigned to their device So, if John Doe tries to login to LAPTOP-ABC321, he should not be able to.To achieve this how can we make sure it is common for everyone based on their name (example - like a string value how we would use %USER%) Is there something like that so I can put that as the value ?Administrators AzureAD\email address removed for privacy reasons - This is going to be specific for that user, but what about in general,Moreover, we do not want the user who is logging into the computer as an admin, we have separate admin account.

moe_kinani · Answer

Hi Oryxway,Is this what you looking for?https://www.inthecloud247.com/restrict-which-users-can-logon-into-a-windows-10-device-with-microsoft-intune/Moe

oryxway390 · Answer

Moe_Kinani&nbsp;Yes, that is the one. But, I am not sure about that string that is there. What does that string do there?&nbsp;We already have an account as a local admin account. but we just need to make sure that only that user assigned the device should be able to login. In order to achieve what should be the string?

moe_kinani · Answer

This policy should do it for you. The OMI is basicslly allowing AllowLocalLogon by using locsl Administrators group + Azure AD user you want to allow. So the value would like below:

Administrators AzureAD\email address removed for privacy reasons

Hope this helps!
Moe

Forum Discussion

Allow only user account that is assigned to the device

Share

Resources