Disabling the owner of an Entra joined device removes it from Intune

Question

When an Entra user is disabled, not deleted, the assigned device is removed from Intune. When this happens, the only options I see are local password and face login for that particular user, effectively making the machine unusable. I also cannot wipe or reset the machine remotely since it's been removed from MDM.

The devices are enrolled via Autopilot without user affinity. Primary users are set manually in Intune.

I've looked through all policies and have not found what could be triggering this. Device clean-up rules are not enabled in Intune.

I came across this article, but we are not deleting the user and others online aren't experiencing this.

https://techcommunity.microsoft.com/blog/intunecustomersuccess/offboarding-users-from-microsoft-endpoint-manager-%E2%80%93-microsoft-intune/3260365

Any help would be appreciated.

Answer 1

Hi,

We’ve noticed that when a user account is disabled in Active Directory, Intune automatically removes the email account from the user’s device. However, other device policies continue to remain in place on the phone.

Do you have any explanation for this behavior?

Answer 2

Hi, when you block an Entra user, their Intune license is immediately revoked. If they were Enrolled-by for a device (without a device-level license), check-in fails and Intune retires the device, which disappears from the console and remains with local access only

Even with Autopilot self-deploying, you still need a device license or a licensed user. If you then assign a Primary user, Intune uses that license to manage the device. If you disable that user, the license disappears and the device is retired

To avoid this, you have three options:

-Assign a device license (e.g. Intune Plan 1 Device) before disabling the user: this way the device remains managed even without active users

-Block access without removing the license: you set Block sign-in but leave the license until you Wipe or Retire, maintaining remote control

-Use a service account for enrollment: You enroll devices with a “Provisioning” account that is never disabled, so management is not dependent on end users

When the device is switched to a new user, you can simply assign a new Primary user or do a Wipe and Reset Autopilot