Remove the primary user from Intune devices with powershell (Switch to shared device)
All / Intune / Powershell / Windows

Remove the Primary User from Intune Devices with PowerShell (Shared Device)

jannikreinhard11 Comments

If an Intune device is not enrolled as a shared device or kiosk device, it always has a primary user. This creates a relation between the device and the user. This user is also used to license the device. This user only has the possibility to see this device in the company portal / company portal website and trigger certain self service actions. Also, while troubleshooting, an Intune admin can select this user in the Troubleshooting + support menu in Intune and directly see their devices.

The primary user is automatically added after the enrollment of an Intune managed device. It is possible to change the user to an other or remove this user to switch the device to a shared device.

Where can I find the Primary User

  • Open the Intune Portal
  • Click Devices -> All Devices
  • Select a Device
  • Click Properties

In this overview you can find the primary user. You also have the possibility to change or remove the user.

Remove the primary user from Intune devices with powershell (Switch to shared device)

How can I remove the primary user to switch the device to a shared device?

When a device has no primary user assignment, it is categorized as a shared device. These shared devices are identifiable through a unique identification label displayed in the company portal. In this shared mode, all users have the capability to install apps on the device. However, self-service actions are not accessible when devices are operating in shared mode.

In this section we will look at how you can delete the primary user of all devices / a list of devices automatically via a powershell script.

In the GitHub repository from Microsoft there is a script which shows how to change and delete the primary user for a single device. We have rewritten this script to loop through multiple devices as well to move this to the Graph SDK to make it easier to change.

I have uploaded the customized script to my Git repository. Before you run it, you should adjust the filter so that only the devices you want to change are touched.

Here is an example how to add a filter to only update Windows devices with a specific version: 

$filter = "*10.0.19045*"
if(-not ($filter -eq '*')){
    $allDevices = $allDevices | Where-Object {$_.osVersion -like $filter}
}
Remove the primary user from Intune devices with powershell (Switch to shared device)

I hope I could help you with the blog.

Stay healthy, Cheers
Jannik

11 thoughts on “Remove the Primary User from Intune Devices with PowerShell (Shared Device)”

  1. How could this be used to delete the primary user for devices within a specific group? im super new at managing intune with powershell. Thank you!

  3. How can I adjust the filter, or how can I get it to process more than 2000 computers?

    • You need here an loop for the paging or you can also use the powershell graph sdk with the parameter -all. If you need support here let me know then I will provide you the script to do this.

  4. Hi. I am trying to run Get-Win10… but its not recognize the cmlets. Installed and imported ADAzure, ADAzurePreview and even Microsoft.Graph.Intune modules but still not joy. Any ideas?

  5. Hi. I am trying to run the above script as well and i get an error “Delete-IntuneDevicePrimaryUser : The term ‘Delete-IntuneDevicePrimaryUser’ is not recognized as the name of a cmdlet, function, script file, or operable program. Check
    the spelling of the name, or if a path was included, verify that the path is correct and try again.
    At line:8 char:5
    + Delete-IntuneDevicePrimaryUser -IntuneDeviceId $deviceEntry.id -E …
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : ObjectNotFound: (Delete-IntuneDevicePrimaryUser:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

  6. Hello! I was able to bypass 2 of the errors. One error was if a user did not have an Intune license (test account) and the other error I was able to bypass by commenting out a Break.

    My issue now is, the script completed after going through all devices that Start with a “C”. Is there a limit or a timeout period?

Comments are closed.