Intune-Set-PrimaryUsers.ps1 - Exclude devices and remove UPN for shared devices

[CSSVT-mirong]

Hi,

First of all, thank you for this excellent script, we are currently using it in our school district environment and it works very well.

I would like to suggest two possible enhancements that could benefit education and shared-device environments.

1 . Exclude devices based on name suffix

Currently, the $ExcludedDeviceNames parameter allows exclusion based on prefix patterns. In our organization, we also need to exclude devices that end with specific suffixes (for example shared/public/test devices).

To support this, I've added a new parameter :

[Parameter(Mandatory = $false, HelpMessage = "Filter to exclude devicenames that end with specific suffixes.")] [string[]]$ExcludedDeviceSuffixes = @('),

And modified the regex filter (what I've added in between # === NEW === # comments) :

        # Apply client-side name filters
        if (
            ($IncludedDeviceNames -and $IncludedDeviceNames.Count -gt 0) -or 
            ($ExcludedDeviceNames -and $ExcludedDeviceNames.Count -gt 0) -or 
            # === NEW=== #
            ($ExcludedDeviceSuffixes -and $ExcludedDeviceSuffixes.Count -gt 0)
            # === NEW=== #
        )
        
        {
            [string]$IncludePattern = if ($IncludedDeviceNames -and $IncludedDeviceNames.Count -gt 0) {
                '^(' + (($IncludedDeviceNames | ForEach-Object { [regex]::Escape($_) }) -join '|') + ')'
            } else { $null }
            [string]$ExcludePattern = if ($ExcludedDeviceNames -and $ExcludedDeviceNames.Count -gt 0) {
                '^(' + (($ExcludedDeviceNames | ForEach-Object { [regex]::Escape($_) }) -join '|') + ')'
            } else { $null }
            # === NEW === #
            [string]$excludeSuffixPattern = if ($ExcludedDeviceSuffixes -and $ExcludedDeviceSuffixes.Count -gt 0) {
                '(' + (($ExcludedDeviceSuffixes | ForEach-Object { [regex]::Escape($_) }) -join '|') + ')$'
            } else { $null }
            # === NEW=== #
            $AllDevices = $AllDevices | Where-Object {
                $IncludeMatch = if ($IncludePattern) { $_.deviceName -imatch $IncludePattern } else { $true }
                $ExcludeMatch = if ($ExcludePattern) { $_.deviceName -notmatch $ExcludePattern } else { $true }
                # === NEW === #
                $excludeSuffixMatch = if ($excludeSuffixPattern) { $_.deviceName -notmatch $excludeSuffixPattern } else { $true }
                # === NEW === # 
                $IncludeMatch -and 
                $ExcludeMatch -and 
                # === NEW=== #
                $excludeSuffixMatch 
                # === NEW=== #
            }
            if ($IncludePattern) { Write-Verbose "Applied inclusion filter for $($IncludedDeviceNames.Count) patterns" }
            if ($ExcludePattern) { Write-Verbose "Applied exclusion filter for $($ExcludedDeviceNames.Count) patterns" }
            # === CSSVT === #
            if ($excludeSuffixPattern) { Write-Verbose "Applied exclusion filter (suffixes) for $($ExcludedDeviceSuffixes.Count) patterns" }
            # === CSSVT === #
            Write-Verbose "Remaining after filters: $($AllDevices.Count) devices"
        }
        # Create hashtable for fast lookups
        $AllDevicesByIdHash = Convert-PSObjectArrayToHashTables -PSObjectArray $AllDevices -IdProperties @('id')
        Write-Verbose "Created device lookup hashtable with $($AllDevicesByIdHash.Count) entries"
    }
    else {Write-Warning "No devices found in tenant"}
}
catch {
    Write-Error "Failed to get devices: $($_.Exception.Message)"
    throw
}

Would you consider integrating native suffix-based filtering into the script please?

2 . Option to remove Primary User for excluded/shared devices

In school/public environments, shared devices must not have a Primary User assigned.
If they do, students cannot properly use Company Portal on public workstations.

It would be very helpful to have an option such as :

-SkipAndClearPrimaryUserForExcludedDevices

Or something similar, allowing the script to:

• Detect excluded/shared devices
• Automatically remove the Primary User assignment
• Leave them unassigned

This would make the script even more useful for education and shared device scenarios.

Thanks again for your great work.

We really appreciate the effort you put into maintaining and sharing this script with the community.

Best regards,

[Mr-Tbone]

Nice feedback, I will take a look at it.