Security Policy Errors

How to Remove an Enrolled User from a Windows Device in Intune

Rana Garcia Oct 21, 2026 868 views

Question details

The user needs to remove an enrolled user association from a managed Windows device to pass Microsoft Endpoint compliance requirements.

How to Remove an Enrolled User from a Windows Device in Intune

Product: Microsoft Intune
Device & OS: Windows
Scenario: Managing user profiles and resolving device compliance failures in Microsoft Endpoint Manager.
Observed behavior: A Windows device fails a compliance requirement because an enrolled user remains associated with it, and deleting the local Windows profile does not fix the Endpoint user association.

Before you start

Ensure you have Microsoft Intune Administrator privileges or equivalent permissions to manage device enrollments and change primary user assignments.

Solution 1Recommended

Change or Remove the Primary User in Microsoft Endpoint Manager

Reassign or remove the primary user associated with the device directly through the Microsoft Endpoint Manager admin center to resolve the compliance issue.

Deleting a local user profile on a Windows machine only removes the data locally. The device's management record in Intune still lists the user as the primary enrolled user. You must break this association in the Endpoint portal.

Access Endpoint Manager

Locate the Device

Navigate to 'Devices' and select 'All devices'. Search for and select the specific Windows device that is failing the compliance check.

Open Device Properties

Click on 'Properties' under the 'Manage' section on the left-hand navigation menu.

Modify Primary User

Locate the 'Primary user' section and click 'Change primary user' to assign a new user, or 'Remove primary user' to convert it to a shared device.

Sync and Reevaluate

Save your changes. Go back to the device Overview page and click 'Sync' to force the device to check in with Intune and reevaluate compliance.

Change or Remove the Primary User in Microsoft Endpoint Manager

Administrator Access Required: If you do not see the option to change the primary user, the required controls may be restricted. Contact your Microsoft Intune administrator.

Solution 2

Consult the Microsoft Configuration Manager Community

If the device is co-managed or the Endpoint user associations persist due to complex on-premises synced policies, consult specialized support.

Free Microsoft Office alternative

Looking for a Lightweight Office Suite? Try WPS Office

While Microsoft Intune effectively manages your Windows device ecosystem, you might also need an efficient, cost-effective productivity suite for your organization's users. WPS Office provides a fully compatible, lightweight, and free alternative to Microsoft Office, ensuring seamless document management across all your managed devices.

Highly compatible with Microsoft Office formats including .docx, .xlsx, and .pptx.Lightweight installation ideal for managed Windows devices with limited storage or bandwidth.Free to use with a familiar, easy-to-adopt user interface that requires zero retraining.Reduces software licensing overhead while maintaining full organizational productivity.

microsoft office alternative - wps office

Frequently Asked Questions

Why does deleting the local Windows profile not remove the Endpoint user association?

Local profile deletion only removes the user data and registry entries on the physical device itself. The device's management record in Azure AD and Intune still retains the user as the primary enrolled user until it is explicitly reassigned or removed in the Endpoint Manager.

How long does it take for the Intune compliance status to update after changing the primary user?

Once the primary user is updated in the admin center, it can take up to 15-30 minutes for the change to propagate. You can accelerate this process by manually initiating a device sync from the Intune portal or the device's Work/School account settings in Windows.

Can a Windows device have no primary user in Intune?

Yes, devices can be configured as shared devices (without a primary user). This setup is commonly used for kiosks or shared workstations. To transition to this state, you simply use the 'Remove primary user' option in the device properties.

Microsoft Office Security Issues