Script for changing primary user

$tenantId = "xxxxxxxxxxxxxxx"
$clientId = "xxxxxxxxxxxxxxx"
$clientSecret = "xxxxxxxxxxxxxxx"

$body = @{
    grant_type    = "client_credentials"
    client_id     = $clientId
    client_secret = $clientSecret
    scope         = "https://graph.microsoft.com/.default"
}

$tokenResponse = Invoke-RestMethod -Method Post -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" -ContentType "application/x-www-form-urlencoded" -Body $body
$accessToken = $tokenResponse.access_token

$secureAccessToken = ConvertTo-SecureString -String $accessToken -AsPlainText -Force

Connect-MgGraph -AccessToken $secureAccessToken

$UserPrincipalName = "[email protected]"

$ManagedDeviceID = "xxxxxxxxxxxxxxx"

#Function to make Microsoft Graph API calls
Function Invoke-MsGraphCall {

    [cmdletBinding()]
    param(
        [Parameter(Mandatory=$True)]
        [string]$URI,
        [Parameter(Mandatory=$True)]
        [string]$Method,
        [Parameter(Mandatory=$False)]
        [string]$Body
    )



    #Create Splat hashtable
    $graphSplatParams = @{
        Headers     = @{
            "Content-Type"  = "application/json"
        }
        Method = $Method
        URI = $URI
        #ErrorAction = "SilentlyContinue"
    }

    #If method requires body, add body to splat
    If($Method -in ('PUT','PATCH','POST')){

        $graphSplatParams["Body"] = $Body

    }


    #Return API call result to script
    #$MSGraphResult = Invoke-RestMethod u/graphSplatParams
    $MSGraphResult = Invoke-MgGraphRequest u/graphSplatParams

    #Return status code variable to script
    Return $MSGraphResult

}

    #Get managed device and check for primary user --> This works
    $URI = "https://graph.microsoft.com/beta/deviceManagement/managedDevices/$ManagedDeviceID/users"
    $Method = "GET"

    $MSGraphCall = Invoke-MsGraphCall -AccessToken $AccessToken -URI $URI -Method $Method -Body $Body


    $PrimaryUser = $MSGraphCall.value.UserPrincipalName
    $PrimaryUserId = $MSGraphCall.value.id

    #Get AAD Id of primary user to assign -> This also works
$URI= "https://graph.microsoft.com/beta/users/$UserPrincipalName"
$Method = "GET"

$MSGraphCall = Invoke-MsGraphCall -AccessToken $AccessToken -URI $URI -Method $Method -Body $Body
$UserID = $MSGraphCall.id


    #Update Primary User on Managed Device -> This failes
    #Create required variables
    Write-Output "Updating primary user on Intune Device ID $ManagedDeviceID. New Primary User is $UserPrincipalName, ID: $UserID"
    $Body = @{ "@odata.id" = "https://graph.microsoft.com/beta/users/$UserId" } | ConvertTo-Json
    $URI = "https://graph.microsoft.com/beta/deviceManagement/managedDevices('$ManagedDeviceID')/users/`$ref"
    $Method = "POST"


    #Call Invoke-MsGraphCall
    $MSGraphCall = Invoke-MsGraphCall -AccessToken $AccessToken -URI $URI -Method $Method -Body $Body