MP.RKS.IA.1005: The primary user of every Windows device is enabled
| ID | MP.RKS.IA.1005 |
| Severity | Medium |
| Suite | RKSolutions Intune Anomalies |
| Product | Intune |
| Feature | Device enrollment |
| Security area | Devices and endpoints |
| Resource type | Device |
| User impact of fixing | Low |
| Effort to fix | Low |
| Provides evidence for | ISO 27001:2022: A.8.1 (partial), A.5.9 (partial)UAE IA v1.1: T5.7.1 (partial), T1.2.1 (partial)What this means |
| Reads from | Microsoft Graph |
| Licence needed | INTUNE_A |
What this checks and how to fix it
Section titled “What this checks and how to fix it”The primary user of a device is the person it belongs to. When that account is disabled, the person has usually left, and the device should be collected, wiped or given to someone else. The test lists Windows devices whose primary user is disabled in Microsoft Entra ID.
Remediation action
Section titled “Remediation action”- For each device below, collect it, then wipe or retire it in the Microsoft Intune admin center under Devices > Windows.
- Or change its primary user to the person who uses it now (Properties > Primary user).
Related links
Section titled “Related links”Mito check, based on RKSolutions Intune Anomalies by Roy Klooster. Author: royklo. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.