macOS ADE Enrollment

Hello Mian,
Based on current Microsoft and Apple documentation, your understanding is correct for this scenario: when a macOS device is enrolled through Automated Device Enrollment with Apple Business Manager and the user authenticates during Setup Assistant, the enrollment and user context are bound to the identity that completes Setup Assistant, and this remains the effective user identity for user based management moving forward. Changing the Primary User field in the Intune admin center after enrollment does not rebind macOS to a different user in the same way it does for Windows; instead, macOS continues to rely on the original enrollment user for user targeted app and policy evaluation, while device targeted assignments continue to apply normally. Platform SSO with Microsoft Entra ID further reinforces this behavior because it provisions identity artifacts such as the workplace join certificate and local account mapping during enrollment and user sign in, and these are not reissued simply by changing the Primary User attribute post enrollment. As a result, if you need a different user to fully take ownership of the device for user based assignments, Microsoft guidance and real world behavior indicate that a wipe and re enrollment through ADE with the new user signing in during Setup Assistant is required for a clean and supported outcome. Relevant documentation for reference includes the Intune macOS enrollment overview at https://dori-uw-1.kuma-moon.com/en-us/intune/device-enrollment/apple/guide-macos, Platform SSO for macOS with Intune at https://dori-uw-1.kuma-moon.com/en-us/intune/intune-service/configuration/platform-sso-macos, and Apple’s description of Platform SSO during enrollment at https://developer.apple.com/documentation/devicemanagement/implementing-platform-sso-during-device-enrollment.

For macOS devices enrolled through Automated Device Enrollment (ADE) with user affinity, Intune ties the device’s user association to the identity that completes Setup Assistant at enrollment time, not to later changes of the Primary User field.

From the documented behavior:

• For iOS/iPadOS and macOS with Apple Automated Device Enrollment (DEP/ADE with User Affinity), the enrolling user is automatically assigned as the primary user during enrollment:
  • “iOS/iPadOS, macOS | Apple Automated Device Enrollment (DEP with User Affinity) | Enrolling user | During enrollment.”
• For ADE without user affinity, there is no primary user and user-based targeting does not apply.

This means:

• The user who authenticates in Setup Assistant (with modern auth or legacy) becomes the Intune primary user at enrollment time.
• Changing the Primary User later in the Intune admin center does not change the original enrollment identity on the macOS device itself; it only changes Intune’s logical primary user association.
• App and policy targeting behavior depends on how assignments are scoped:
  • Device-based assignments (to the device, device groups, or all devices) continue to apply regardless of primary user changes.
  • User-based assignments are evaluated against the currently signed-in user’s Microsoft Entra ID and group membership. Changing the Intune primary user does not re-enroll the device or change which Entra ID account the Platform SSO session and Setup Assistant enrollment were originally bound to.

Therefore, the understanding is correct: macOS ADE enrollment is fundamentally tied to the user who completes Setup Assistant with their Microsoft Entra credentials. Updating the Primary User field in Intune after enrollment does not change that underlying enrollment identity and does not by itself “rebind” the device to a different user for PSSO or enrollment. The device will still receive:

• All device-targeted apps and policies as normal.
• User-targeted apps and policies based on the Entra ID account actually used on the Mac (and its group membership), not solely on the Primary User value stored in Intune.

References:

• Primary users on Microsoft Intune devices
• Enrollment guide: Enroll macOS devices in Microsoft Intune
• Enroll your organization-provided macOS device in management