How to Identify Never-Logged-In Devices in Microsoft Entra ID

Never-logged-in devices and inactive devices are often mistaken for one another, but they are different. Devices that have never been used are generally safe to remove, as they typically don’t store any organizational data. On the other hand, inactive devices were used in the past and may still contain sensitive information, so they must be handled with caution.

Understanding the difference between these two helps you make the right decisions when cleaning up your device inventory.

Managing never-signed-in devices in Microsoft Entra ID is important for keeping your identity environment secure and efficient. Without proper governance, these devices can become security liabilities, clutter your directory, and create compliance gaps. Here are some best practices to implement structured policies and controls for effectively managing never-used devices in Entra ID.

Unmanaged devices are endpoints that are registered in Entra ID but not managed by Microsoft Intune or any other MDM solution. As a result, they are not validated against compliance policies and are considered noncompliant. So, it’s important to identify devices that were never used so you can enroll them in Intune/MDM and make sure they comply with organizational policies.

Identify never-used unmanaged devices using Microsoft Entra

• In Microsoft Entra, navigate to Devices»Overview under Entra ID, and click on Unmanaged devices.
• Then, check for devices with no activity logs by identifying those with N/A in the Activity column.

Export never-used unmanaged devices using PowerShell

To export never-used unmanaged devices from Entra ID, run the following cmdlet after connecting to Microsoft Graph PowerShell and replacing <OutputPath> with your output file location.

Get-MgDevice |
    Where-Object {
        -not $_.ApproximateLastSignInDateTime -and
        -not $_.IsManaged
    } |
    Select-Object DisplayName, Id, RegistrationDateTime, OperatingSystem |
    Export-Csv "<OutputPath>.csv" -NoTypeInformation

Avoid letting never-used devices put your Microsoft 365 organization’s security at risk, as these devices can silently serve as attack vectors and may allow unauthorized access. To prevent this, identify and delete such devices regularly to maintain a proper device lifecycle and a well-governed identity environment.

Remove never-used devices via Entra admin center

• In Microsoft Entra admin center, navigate to All Devices under Entra ID»Devices.
• Then, Select the never-used devices and click Delete from the toolbar.
• Then, click OK in the confirmation prompt to delete the selected devices.

Note:This only removes the device from Microsoft Entra ID. If the device is managed via Intune, you’ll also need to delete it from Intune.

Delete never-used devices from Microsoft 365 using PowerShell

To delete all never-used devices in Microsoft 365, connect to Microsoft Graph PowerShell with the Device.ReadWrite.All scope and run the following cmdlet.

$NeverUsedDevices = Get-MgDevice -All | Where-Object { -not $_.ApproximateLastSignInDateTime }
$NeverUsedDevices | Select DisplayName, Id
(Read-Host "Delete these devices? (Y/N)") -match '^[Yy]$' ? (
    $NeverUsedDevices | ForEach-Object {
        Remove-MgDevice -DeviceId $_.Id
        Write-Host "Deleted: $($_.DisplayName)"
    }
) : (Write-Host "Deletion cancelled.")