Admins unable to update Primary user for Intune managed device

Correlate the device’s local DeviceId with the Entra device ID referenced by its Intune record before changing or deleting anything, because a blank Join type alone does not establish whether Intune is linked to the active hybrid-joined identity.

1. Identify the device object Intune is managing

On the affected Windows device, open an elevated Command Prompt and run:

dsregcmd.exe /status

Record these values from Device State:

• AzureAdJoined
• DomainJoined
• DeviceId
• TenantId

For a functioning hybrid-joined identity, both AzureAdJoined and DomainJoined should reflect the hybrid state. Microsoft specifically recommends checking the client with dsregcmd.exe /status and matching its device ID against the object in Microsoft Entra ID → Devices → All devices.^1^

Then compare the local DeviceId with:

1. The Entra ID of the Microsoft Entra hybrid joined object.
2. The Entra ID associated with the device record in Intune admin center → Devices → All devices → affected device.
3. The second Entra object whose Join type is blank.

Record the Intune managed-device ID and both Entra object IDs before making changes. Also ensure the BitLocker recovery key is backed up if the device is encrypted.

2. Act according to the identity mapping

If Intune maps to the hybrid-joined object

The device meets the documented join-state requirement for changing its primary user. The supported portal path is:

Intune admin center → Devices → All devices → device → Properties → Change primary user

The feature supports Windows devices that are Microsoft Entra joined or hybrid joined, but not devices that are only Microsoft Entra registered. It also requires the target user’s Intune license and the operator’s Managed devices/Set primary user permission.^2^

Since those prerequisites are already satisfied and the control remains unavailable, do not repeat the PowerShell attempt or delete either object. Open a Microsoft Intune support case and provide:

• Intune managed-device ID
• Local dsregcmd /status output
• Matching Entra DeviceId
• Both Entra object IDs and their join types
• Enrollment method
• Screenshot showing the unavailable Change primary user control
• Timestamp and administrator account used for the attempt

This establishes whether the tenant has an incorrect managed-device association or a service-side issue.

If Intune maps to the blank-Join-type object

First determine whether that object is actually Microsoft Entra registered. If it is, changing the primary user is unsupported for that managed-device association, even though a separate hybrid-joined object exists.^2^

Do not simply delete the blank-join object expecting Intune to merge or remap it. Similar separate join/enrollment objects generally do not merge automatically.^3^

Use a Microsoft-supported, tenant-specific remediation plan to remove the incorrect registration and reenroll through your organization’s established hybrid automatic-enrollment method. This is important because removing the Microsoft Entra registered state can also unenroll the device from Intune when MDM enrollment was created through that registration.^4^

3. Expected result after correction

Once Intune is associated with the active hybrid-joined identity, Change primary user should be available under the device’s Properties page. After selection, allow up to 10 minutes for the new primary user to appear across Intune and Entra ID.^2^

Changing the primary user:

• Does not change the Intune Enrolled by value.
• Does not add the new user to the device’s local Administrators group.
• Changes the primary-user association used by Intune and Company Portal.^2^

References

1. Microsoft Entra device management FAQ
2. Change a device's primary user in Microsoft Intune
3. Duplicate AAD Device, 1 for MDM (Intune) and the other is the joined device (not Hybrid joined) - Microsoft Q&A
4. Plan your Microsoft Entra hybrid join implementation