# How to create a multi user device configuration in Intune

## Intro

Organisations may operate with desktops that aren't assigned to a single person. This may be for hot desking purposes or something else specific to their organisation.

This sort of requirement requires a specific multi user configuration. This is something we can solve utilising Intune and Autopilot.

> Please ensure you have Intune Administrator for these actions

* * *

## Configuring the Autopilot profile

Start by navigating to [Windows Autopilot deployment profiles - Microsoft Intune admin center](https://intune.microsoft.com/#view/Microsoft_Intune_Enrollment/AutopilotDeploymentProfiles.ReactView).

Select **Create profile** then **Windows PC.**

Give the profile a name and description so other admins are aware of the utilisation for this device. I've chosen *Autopilot Multi User Desktops.*

Then ensure on the next screen that **Deployment mode** is set to Self-Deploying. This will grey out a number of options, you can still choose the language, keyboard and assign a device name template. I've gone for MULT-%SERIAL%.

> A self deploying profile is a profile where the devices are not associated with the user enrolling the device and user credentials are not required to provision the device.
> 
> The profile will automatically start the enrolment once it has checked in with the Intune service.

![](https://cdn.hashnode.com/uploads/covers/69c01ab5d9da55a9a5b416d5/bc7e6e2e-87e9-4436-8bce-8843540975d5.png align="center")

Assign this to your Multi User Device Group (this can either be a static or dynamic device group).

* * *

## Configuration Profiles

Navigate to [Create a profile - Microsoft Intune admin center](https://intune.microsoft.com/#view/Microsoft_Intune_DeviceSettings/DevicesWindowsMenu/~/configuration) and select **Create**

### Settings Catalog - Shared PC

The first part of our policy will be using the **Shared PC** category.

I've chosen the following settings as we don't require the Kiosk Mode, and we will be using Shared PC Mode with One Drive as I'm planning to restrict access to certain parts of C:\\.

I would recommend at minimum enabling the following:

**Enable Shared PC Mode (or with OneDrive Sync)**

**Enable Account Manager - *true***

**Set Power Policies -** ***true***

**Deletion Policy -** ***(Whatever you prefer but you would benefit from removing at a certain threshold)***

![](https://cdn.hashnode.com/uploads/covers/69c01ab5d9da55a9a5b416d5/bcaf38fe-9ec6-4af4-b2cb-34222d912fa5.png align="center")

### Settings Catalog - Windows Hello For Business

To ensure the device has seamless sign in, we must disable WHFB. Find the category within the settings catalog and then ensure the following settings are selected.

**Use Windows Hello For Business (Device) - Set to *false***

**Use Windows Hello For Business (User) - Set to *false***

**Use Security Key For Signin - Set to *Disabled***

**Dynamic Lock - Set to *Disabled***

**Allow use of Biometrics - Set to *False***

![](https://cdn.hashnode.com/uploads/covers/69c01ab5d9da55a9a5b416d5/d90adc11-2443-4204-b401-11ccaa64639f.png align="center")

Assign the policy to your autopilot group and that is complete.

### Optional - Settings Catalog - Start Menu configuration

If your organisation requires certain things on the start menu, or you just feel like the start menu shouldn't be edited then you can configure some further controls. For my setup I have chosen the following.

**File Explorer**

![](https://cdn.hashnode.com/uploads/covers/69c01ab5d9da55a9a5b416d5/c1d9572f-e38c-47f8-868f-299f900c2661.png align="center")

**Start**

![](https://cdn.hashnode.com/uploads/covers/69c01ab5d9da55a9a5b416d5/02f742ef-6a90-46ad-b287-17c2997e4a2f.png align="center")

* * *

## How does deployment look?

In OOBE, once the network is done, it will automatically pull the Intune Autopilot profile (it may restart) and will start the onboarding process.

![](https://cdn.hashnode.com/uploads/covers/69c01ab5d9da55a9a5b416d5/a0e1ea71-c058-491b-beca-fac4ef89c4c7.png align="center")

At the account setup stage there is the requirement for a user login, however after we've done our deployment we can see the user experience when logging in and out.

My machine has deployed, if I login with my user credentials we get straight in, no WHfB needed.

![](https://cdn.hashnode.com/uploads/covers/69c01ab5d9da55a9a5b416d5/1232b0e7-2e2f-4949-a95f-0fe16fd9253a.png align="center")

![](https://cdn.hashnode.com/uploads/covers/69c01ab5d9da55a9a5b416d5/8af1be36-e591-4584-981e-2ddac618d50e.png align="center")

If we restart the machine we can see then that the user profile is not cached.

![](https://cdn.hashnode.com/uploads/covers/69c01ab5d9da55a9a5b416d5/6b77ef5f-3294-4c70-9f1c-6e2d3b9bb9b1.png align="center")

The next user who signs in won't have to do WHfB either, therefore you have an easy multi user build!

* * *

## Closing notes

Multi user builds are ideal for when device sharing is needed, to save money on standalone user desktops and to simplify hot desks internally.

With your new build you can go further and customise it for different department or office areas. Keep the initial Autopilot build group and then apply custom supplementary settings catalog, policies and apps to make it easier for your users.

I hope this helps you in your Intune journey :)