🚀 Overview: User Identity and Access Management in Microsoft Intune

In the modern endpoint management landscape, identity is the primary security perimeter. For Microsoft Intune to effectively manage devices and secure corporate data, every individual must be represented by a distinct user account within the tenant. This guide provides a deep dive into the manual provisioning of user identities and the subsequent entitlement process via license assignment.

As part of an initial environment setup or a proof-of-concept (PoC) evaluation, IT administrators must ensure that users are not only created but also correctly licensed to trigger the enrollment workflows. This document details the specific administrative paths and role requirements necessary to move a user from a simple identity to a managed entity.

⚙️ Key Technical Details

🛡️ Prerequisites and Administrative Roles

• Subscription: An active Microsoft Intune subscription is mandatory. For testing purposes, a trial tenant is sufficient.
• RBAC Requirements: To perform these actions, the administrator must be signed into both the Microsoft Intune admin center and the Microsoft 365 admin center with the Built-in User Administrator Microsoft Entra role.

👤 Step-by-Step User Provisioning

Before a device can be enrolled, a corresponding identity must exist in Microsoft Entra ID (formerly Azure AD). This identity acts as the anchor for all MDM (Mobile Device Management) policies.

1. Navigate to the Microsoft Intune admin center.
2. Follow the path: Users > All users > New user.
3. Identity Identification: In the Name field, enter the full display name (e.g., Dewey Kellum).
4. UPN Configuration: In the User name box, enter the unique User Principal Name (UPN), such as [email protected].
   • Technical Note: If a custom vanity domain has not been verified, you must use the default .onmicrosoft.com domain associated with your tenant.
5. Credential Management: Select Show password. Ensure you capture this temporary password, as it is required for the initial sign-on and device enrollment phase.
6. Click Create to commit the user to the directory.

🔑 License Entitlement Mechanics

Creation of an identity does not automatically grant the right to use the Intune service. You must explicitly assign a service plan to the user.

1. Access the Microsoft 365 admin center.
2. Navigate to Users > Active Users and select the specific account you just generated.
3. Select the Licenses and Apps tab.
4. Geographic Location: Set the Select location field. This is a requirement for assigning licenses due to regional compliance and availability.
5. Service Plan Selection: Under the Licenses section, check the box for Intune. Note that Intune is often bundled in suites like Enterprise Mobility + Security (EMS) or Microsoft 365 Business Premium.
6. Finalize by selecting Save changes.

📂 Bulk Licensing Operations

For enterprise-scale deployments, individual assignment is inefficient. Administrators can utilize the billing node for group-based or multi-user licensing:

• Navigate to Billing > Licenses in the Microsoft 365 admin center.
• Choose the specific Intune-inclusive product.
• Select Assign licenses and target either specific Users or Groups.
• Review the assignment status notification to ensure there are no license conflicts (e.g., overlapping service plans).

🧹 Resource Decommissioning

To maintain tenant hygiene after testing is complete, users can be removed by navigating to Users > Active users in the Microsoft 365 admin center, selecting the user, and choosing Delete user.

⚠️ Impact

Establishing these identities has several immediate impacts on the environment:

• Enrollment Readiness: Users are now technically capable of enrolling devices (Windows, iOS/iPadOS, Android) via the Company Portal app or OOBE (Out-of-Box Experience).
• Security Policy Application: Once licensed and enrolled, the user becomes a targetable object for Configuration Profiles, Compliance Policies, and Conditional Access rules.
• Resource Consumption: Each assignment consumes one seat from your available license pool. In trial environments, monitoring this consumption is critical to avoid provisioning failures for subsequent test users.
• Automation Opportunities: While this guide covers manual entry, these steps form the logic used by automated tools like School Data Sync (SDS) or Microsoft Entra Connect for hybrid environments.

Official Source: Read the full article on Microsoft.com