Change Enrolled by user to a different user!!!

Question

I have a device with two different user:

Primary user is : X
Enrolled by: Y (the user is deleted)

I want to change the enrolled by user to x user in microsoft endpoint manager.

Does that possible by script or any other way to do it?

Best,
Barzan

Answer 1

That's not good that you HAVE TO wipe commputer before next user will use Device. Wiping should be an option as changing enrolled user.
What in case that we have 3 person team, everyone have ME3 license (intune included) but they need to work on 1 commputer (example shift work for 24h) ? If one of this person will be "Enroller" and that person suddenly chcange job (disabled account) we will have non-compliant Device for others - because "Enroller" quit a job.
In my case I want to change or delete owner of device that others maintain work without restoring device.

Answer 2

@Dan R

As an admin setting up devices, I'm always enrolling the devices using my admin account, I'm not taking a laptop out to the user, asking them to enroll the device only so I can take it back and finish configuring it before then bringing it back to them

The entire point of modern management is not doing exactly this though. If you haven't automated the configuration and removed the need to actually perform configuration, you're effectively creating your own problems here. You, the IT admin, should simply not be doing this and our entire design assumes you aren't.

it's not possible to automate every little thing all the time.

I disagree with this statement -- it sometimes takes a little creativity, ingenuity, and/or research but I've never found anything in Windows where this is true -- there is always a code path because everything is ultimately code. Even if you disagree with this, it doesn't change the reality of how we've built process and mechanisms -- as noted, this is a core assumption about how devices should be provisioned (you may also disagree with this statement but it also doesn't change it). Thus, you more or less have two choices: Automate or give the end user instructions on how to complete the configurations. I guess you could also eliminate the configuration altogether as well which I often find is also valid as many orgs over configure and configure because they can and not because they should. What works best for your org from among these options is up to you but fighting against the core design assumption is the source of your friction and this should prompt you you to rethink your process.

Answer 3

If the restriction that concerns is to enroll more devices one option to consider is to add the user as a "Device enrollment managers".

The documentation states that is possible to enroll up to 1,000 devices as a enrolment manager.

Add device enrollment managers

Answer 4

Has anybody ever found a solution to this? So scenario is we just took over from another IT company a few months ago. We deleted their accounts after a few weeks and now 5 weeks later we are starting to notice they setup the devices using those accounts and they are non compliant. This is around 90ish devices now non compliant.

Surely we cant have to wipe 90 devices? That would be a bad start to our IT.....

We cant restore the deleted accounts as past 30 days and clearly it would be bad practice to leave the old providers accounts in place anyway.

Answer 5

This device enrollment problem is causing conditional access security problems.

Conditional access is desired to be configured to allow logins only on compliant devices. A device can easily become non-compliant if it was enrolled in Intune using the end user account. There must be a way to change the enrollment account for a device remotely.

"Reset the device" is not viable. Microsoft needs to fix this issue.