How to Find Stale Devices in Microsoft Entra ID

Inactive devices can pose a security risk if left unchecked, especially if they still have access to organizational resources. So, it's essential to regularly clean up inactive devices from Entra ID to maintain a secure and well-managed environment.

This can be approached in two ways: disabling inactive devices in case reactivation is needed, and permanently deleting devices that are no longer in use.

Disable stale devices from Entra admin center

• In the Microsoft Entra admin center, navigate to Devices»Overview under Entra ID, and click on Stale devices card.
• Then, select the desired devices and click Disable from the toolbar.
• Then, click OK in the confirmation prompt to disable the selected devices.

Note: This only removes the device from Microsoft Entra ID. If the device is managed via Intune, you’ll also need to delete it from Intune.

Delete stale devices from Entra admin center

• In the Microsoft Entra admin center, navigate to Devices»Overview under Entra ID, and click on Stale devices card.
• Then, select the devices you want to remove, then click the Delete option in the toolbar.
• Then, click OK in the confirmation prompt to permanently delete the selected devices.

Note: Before deleting any devices, ensure you back up BitLocker recovery keys associated with them. Once a device is deleted, BitLocker recovery keys cannot be retrieved in Entra ID.

Besides using the Microsoft Entra portal to manage inactive devices, you can also use Microsoft Graph PowerShell to disable or delete them, especially for bulk operations. The following steps show how to disable or delete multiple stale devices at once using PowerShell.

To manage inactive devices, you need to connect with Microsoft Graph PowerShell with the following cmdlet.

Connect-MgGraph -Scopes "Device.ReadWrite.All"

Disable stale devices using PowerShell

To disable all stale devices in Entra ID using PowerShell, run the following script by replacing <Days> and <FilePath> with appropriate values.

$InactiveDays = "<Days>"
$LogPath = "<FilePath>"
Get-MgDevice -All | Where-Object {
    ($_.ApproximateLastSignInDateTime -le (Get-Date).AddDays(-$InactiveDays)) -and
    ($_.AccountEnabled -eq $true)
} | ForEach-Object {
    try {
        Update-MgDevice -DeviceId $_.Id -BodyParameter @{ AccountEnabled = $false } -ErrorAction Stop
        $LogMessage = "Disabled device: $($_.DisplayName) | ID: $($_.Id)"
        Add-Content -Path $LogPath -Value $LogMessage
    }
    catch {
        $ErrorMessage = "ERROR disabling device: $($_.DisplayName) | ID: $($_.Id) | Message: $($_.Exception.Message)"
        Add-Content -Path $LogPath -Value $ErrorMessage
    }
}

Delete stale devices using PowerShell

You can also remove all stale devices from Microsoft Entra ID using the following PowerShell script.

$InactiveDays = "<Days>"
$LogPath = "<FilePath>"
Get-MgDevice -All | Where-Object {
    ($_.ApproximateLastSignInDateTime -le (Get-Date).AddDays(-$InactiveDays)) -and
    ($_.AccountEnabled -eq $true)
} | ForEach-Object {
    try {
        Remove-MgDevice -DeviceId $_.Id -ErrorAction Stop 
        $LogMessage = "Deleted device: $($_.DisplayName) | ID: $($_.Id)" 
        Add-Content -Path $LogPath -Value $LogMessage
    } 
    catch {
        $ErrorMessage = "ERROR deleting device: $($_.DisplayName) | ID: $($_.Id) | Message: $($_.Exception.Message)"
        Add-Content -Path $LogPath -Value $ErrorMessage
    } 
}

Device recovery in Microsoft Entra ID is not as straightforward as restoring a user or group. Once a device is deleted, it cannot be recovered through the Microsoft Entra portal. Instead, users must re-register or rejoin the device depending on how it was originally enrolled.

As an admin, here's what you need to know about managing and guiding users through re-enrolling devices based on their join type, such as Entra-joined, registered, or hybrid-joined. 

Re-register Entra‑registered Windows 10/11 devices

Users can re-add their devices to Microsoft Entra through the Windows settings shown below.

• Navigate to Settings»Accounts»Access Work or School, select the account, and click Disconnect.
• Click on "+ Connect" and register the device again by going through the sign-in process.

Recover Entra‑joined Windows 10/11 devices

For devices joined to Microsoft Entra ID, users can trigger the recovery process by following the steps below.

• Open PowerShell as an administrator and run the following command to recover deleted Entra-joined devices.

  dsregcmd /forcerecovery

• Then, users will be prompted to sign in using their work or school account. After that, they should sign out and sign back in to complete the process.

Re-join Entra hybrid joined Windows 10/11 devices

In the case of hybrid Entra ID joined devices, the recovery process involves leaving the current join state and allowing the user to re-register the device.

Note: These recovery steps are only for Windows 10, Windows 11, and Windows Server 2016+, not supported on macOS or Linux.

Inactive devices may still contain sensitive corporate data. Therefore, it's essential to remove all organizational information from these devices before deleting them from Intune. To support this, Intune allows you to remotely manage data on managed inactive devices and set up automatic cleanup rules to keep your environment secure.

Run remote actions on Intune stale devices

• In the Intune admin center, navigate to Devices»All devices.
• Then, apply a filter using Last check-in, and select the inactive device as needed.
• From the top toolbar, choose Retire, Wipe, or Delete based on your specific requirements.

Below is an explanation of each remote actions you can use to manage stale devices in Intune and their effects.

Note: Retire and wipe actions will work depending on the device’s OS, and its enrollment type, like Azure AD joined or hybrid Azure AD joined. The retire and wipe actions will remain in a pending state until the device reconnects to the network.

Set up auto cleanup in Intune to remove inactive devices

You can set automatic cleanup rules in Intune to remove devices after a set period of inactivity.