Automatically set Intune Primary User based on the logged on User

Comments

9 responses to “Automatically set Intune Primary User based on the logged on User”

1. SAMEER

   2023-05-26

   Hi Mike,
   The script looks great. Im an intune admin and have a task to change the primary user based on the last logged on user.

   I dont have much exp with Intune related PS scripting.

   Would you be kind enough to help me out with the exact process execute the script to update the primary user.

   Reply
   1. mmeierm

      2023-05-26

      Hi,
      thanks that you like my solution.
      I would create an Azure Autmation Account in a Azure Subscription like described in this Blog: https://mikemdm.de/2023/04/02/user-driven-device-group-membership/
      Once you have the Automation Account ready, use the linked Script from Github, modify line 19 of the script to match which devices should be modified, in my example only devices were modified that had a Device Name thats starts with “VM-“, if you want to modify all devices you can also run it without filter, which will look something like this

      $uri = “https://graph.microsoft.com/beta/deviceManagement/managedDevices?`$select=id,usersLoggedOn”

      After you have to assign the needed permission (DeviceManagementManagedDevices.ReadWrite.All) to the Managed Identity using for example the Script from the User-driven Groupmembership here, just modify the line 5 to use the correct permission and delete line 6, 11 and 14, since you only need one permission for this task.

      Let me know, if this helps you or if you need to add more details in my blog at a specific point

      Reply
2. Ramees

   2023-06-22

   Thanks alot for this and I have been looking for this along :). It will be better for me if I can filter the autopilot enrolled devices as i have mobile devices, and personal devices under the managed, it’s giving little hard time 🙂

   Would you be kind to help apply this only for the autopilot enrolled devices

   Reply
   1. mmeierm

      2023-06-23

      Depending on your design, you can choose different options to filter the devices that you want to target. If you are using a Device Name Template in your Autopilot Enrollment Profile, you can target for this in line 19 of the script.

      If you can’t use a Device Name, you can use multiple filters to for example, filter for Corporte owned Windows devices:

      https://graph.microsoft.com/beta/deviceManagement/managedDevices?$filter=managedDeviceOwnerType eq ‘company’ and operatingSystem eq ‘Windows’

      In the Script line 19 could then look something like this:

      $uri = https://graph.microsoft.com/beta/deviceManagement/managedDevices?`$filter=managedDeviceOwnerType eq ‘company’ and operatingSystem eq ‘Windows’&`$select=id,usersLoggedOn

      Reply
      1. Guru8

         2024-03-08

         Hi Mike,

         The script is great.
         How can i modify the script to update devices without primary users as well. Currently, it is only updating devices with wrong primary users.

         Thanks

         Reply
         1. mmeierm

            2024-03-09

            Hi, the script should also add the primary user, this was basically my initaial goal, as my VDI Machines all came without Primary User.
            Can you check via graph explorer if the affected devices have the filed “usersLoggedOn” is filled? We are using this field to determine if and what we should set the primary user.

            https://learn.microsoft.com/graph/api/intune-devices-manageddevice-get?view=graph-rest-beta&WT.mc_id=317638

            Reply
3. OP

   2024-10-09

   Hi Mike,
   we´ve followed the steps you described and we have come across an error 403 (forbidden) when running a script from runbook.
   Checking Device with LoggedonUser

   Got PrimaryUser of Device with ID Error : The remote server returned an error: (403) Forbidden.

   LoggedonUser is different from Primary User, setting Primary User

   Hence the primary user was successfully updated with logged-on user field.
   Could you please have a look and advise what´s the possible cause?

   Reply
   1. mmeierm

      2024-10-09

      Hi, i would suggest to check if the needed App permissions are assigned to the managed identity. Maybe also add “User.Read.All” Permission, I think it should not be needed, but it is worth a try.

      Reply
      1. OP

         2024-10-14

         Hi, it looks like this permission did the trick. Many thanx!

         Reply