This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
The client was using Dem account to enroll the devices to intune and now we need to apply conditional access policies to protect company data. I checked the article which has below limitation for Dem account.
• DEM accounts do not support conditional access because conditional access is intended for per-user scenarios.
We are looking to find a way out with out removing or going through the re-enrollment process of all devices. Can we just change the primary user on those PCs from Dem to standard user and conditional access will work? Computer on intune is showing both Enrolled by and primary user as DEM User Email at the moment.
Regards,
@Talha Thanks for posting in our Q&A.
If you want to deploy conditional access policies to windows devices, it is suggested to change the primary user.
https://learn.microsoft.com/en-us/mem/intune/remote-actions/find-primary-user#change-a-devices-primary-user
Change the DEM user to a normal user and the normal user is needed to have an Azure Active Directory Premium license.
Please deploy conditional access policies to this normal users. And use the normal user account to access the resources protected by conditional access policies.
If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi,
while reading my question again, I realize that it was not as clearly written so I made for changes for clarification.
So just to clarify, you are saying that even though device has been enrolled in intune using DEM user, changing the primary user on device from DEM to standard user(with intune licenses) will allow me to implement conditional access on that device?
I think I can change the primary user on intune enrolled device from portal itself, correct?
@Talha Yes. You can change the primary user on device from DEM to standard user in intune portal. Then you can deploy conditional access policy on the standard user. Please understand that conditional access policy is needed to deploy to user scope.
got it and thanks for clarification on user scope policy part.
That means that even If I leave the DEM user as primary user on that machine, any intune licensed user with policies assigned on him, who is signing in to enrolled device will see policies implemented or should I have to first switch the primary user on device?
thanks
@Talha I have done the test in my lab. Even if I leave the DEM user as primary user on that machine, when I use the standard user included in the target user group, this user will access succesfully. When the user is not included in the target user group, this user will be blocked by the conditional access policy.
So, based on my experience, we can leave the DEM user as primary user on that machine.
Excellent, that exactly what I am looking for. So the line from Microsoft article just mean that policies will not be assigned on DEM user itself but other user logging into the machines will get the conditional access policies.
@Talha Yes. Your understanding is correct. : ）