Admins unable to update Primary user for Intune managed device

Jain01, Sakshi 0 Reputation points
2026-10-15T12:58:41.0766667+00:00

Pre-requisites are already met:

  1. Set/update user permission is already assigned.
  2. New user has Intune license
  3. There are two device entry appearing in Entra ID out of which one is Entra Hybrid joined and another one has no Join type. Device which has no join type is appearing in Intune as well, it is also the impacted device.

4..We have tried updating primary user from PowerShell command but no luck

  1. This error generally occurs when someone leaves organization and admins reset the device.

6.Option to update Primary user from Intune portal is not accessible. Onboarding account is stamped as primary user and we are unable to change it.

Please assist with this issue.

Microsoft Security | Intune | Other
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Baraniwala Chamali Lalanthi Liyanage 530 Reputation points
    2026-10-15T13:01:07.71+00:00

    Hi Sakshi,

    The root cause of this issue is hidden right in your third point: the Intune device record is currently linked to the Entra ID entry that has "no join type".

    When an Intune device record points to an Entra ID object with no join state (instead of the valid Entra Hybrid Joined record), it is essentially an orphaned or "ghost" record. For the "Change Primary user" option to be accessible (not greyed out) in the Intune portal, the device must have a healthy, active trust relationship with Entra ID.

    Because the device was reset (as mentioned in point 5), the old Intune management record lost its original Entra ID trust but was never automatically cleaned up, leaving you with this unmanageable duplicate.

    Here is the standard administrative process to resolve this duplicate/orphaned state so you can assign the new user:

    1. Clean up the orphaned records

    Go to the Entra ID portal and delete the stale device entry that has "no join type".

    Go to the Intune portal and delete the corresponding impacted device record that you are currently unable to edit. (Deleting the Intune record will not wipe the physical device; it just removes the broken management object).

    2. Re-sync the valid device

    Have the new user log into the physical Windows device.

    Open Settings > Accounts > Access work or school.

    If the device is properly Hybrid Joined, the background Intune auto-enrollment policy (usually pushed via GPO or SCCM co-management) will kick in. You can speed this up by forcing a sync from the local device or running dsregcmd /status in Command Prompt to verify the AzureAdJoined state.

    3. Verify and Assign

    • Once the device checks back in, a fresh, healthy record will appear in Intune linked directly to the valid "Entra Hybrid joined" object.
    • Because the new user (with a valid Intune license) initiated the enrollment after the reset, they will automatically be stamped as the Primary User, and the "Change Primary User" button will now be fully accessible for your admins.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-10-15T13:00:19.9833333+00:00

    Correlate the device’s local DeviceId with the Entra device ID referenced by its Intune record before changing or deleting anything, because a blank Join type alone does not establish whether Intune is linked to the active hybrid-joined identity.

    1. Identify the device object Intune is managing

    On the affected Windows device, open an elevated Command Prompt and run:

    dsregcmd.exe /status

    Record these values from Device State:

    • AzureAdJoined
    • DomainJoined
    • DeviceId
    • TenantId

    For a functioning hybrid-joined identity, both AzureAdJoined and DomainJoined should reflect the hybrid state. Microsoft specifically recommends checking the client with dsregcmd.exe /status and matching its device ID against the object in Microsoft Entra ID → Devices → All devices.^1^

    Then compare the local DeviceId with:

    1. The Entra ID of the Microsoft Entra hybrid joined object.
    2. The Entra ID associated with the device record in Intune admin center → Devices → All devices → affected device.
    3. The second Entra object whose Join type is blank.

    Record the Intune managed-device ID and both Entra object IDs before making changes. Also ensure the BitLocker recovery key is backed up if the device is encrypted.

    2. Act according to the identity mapping

    If Intune maps to the hybrid-joined object

    The device meets the documented join-state requirement for changing its primary user. The supported portal path is:

    Intune admin center → Devices → All devices → device → Properties → Change primary user

    The feature supports Windows devices that are Microsoft Entra joined or hybrid joined, but not devices that are only Microsoft Entra registered. It also requires the target user’s Intune license and the operator’s Managed devices/Set primary user permission.^2^

    Since those prerequisites are already satisfied and the control remains unavailable, do not repeat the PowerShell attempt or delete either object. Open a Microsoft Intune support case and provide:

    • Intune managed-device ID
    • Local dsregcmd /status output
    • Matching Entra DeviceId
    • Both Entra object IDs and their join types
    • Enrollment method
    • Screenshot showing the unavailable Change primary user control
    • Timestamp and administrator account used for the attempt

    This establishes whether the tenant has an incorrect managed-device association or a service-side issue.

    If Intune maps to the blank-Join-type object

    First determine whether that object is actually Microsoft Entra registered. If it is, changing the primary user is unsupported for that managed-device association, even though a separate hybrid-joined object exists.^2^

    Do not simply delete the blank-join object expecting Intune to merge or remap it. Similar separate join/enrollment objects generally do not merge automatically.^3^

    Use a Microsoft-supported, tenant-specific remediation plan to remove the incorrect registration and reenroll through your organization’s established hybrid automatic-enrollment method. This is important because removing the Microsoft Entra registered state can also unenroll the device from Intune when MDM enrollment was created through that registration.^4^

    3. Expected result after correction

    Once Intune is associated with the active hybrid-joined identity, Change primary user should be available under the device’s Properties page. After selection, allow up to 10 minutes for the new primary user to appear across Intune and Entra ID.^2^

    Changing the primary user:

    • Does not change the Intune Enrolled by value.
    • Does not add the new user to the device’s local Administrators group.
    • Changes the primary-user association used by Intune and Company Portal.^2^

    References

    1. Microsoft Entra device management FAQ
    2. Change a device's primary user in Microsoft Intune
    3. Duplicate AAD Device, 1 for MDM (Intune) and the other is the joined device (not Hybrid joined) - Microsoft Q&A
    4. Plan your Microsoft Entra hybrid join implementation
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.