What this check looks at
Finds device objects that have not checked in within the staleness window.
Every Windows, Mac, iOS and Android device that joins or registers with Microsoft Entra ID, or comes under Intune management, leaves a device record. When the device is replaced, wiped, lost or handed back, the record stays, still enabled, still holding any BitLocker recovery keys and still counted in reports. Microsoft Entra ID never removes device records automatically, and Intune only does so if a device clean-up rule is set.
This check compares each device record’s last check-in (Intune’s last sync, or Entra ID’s approximate last sign-in) with the staleness window, 90 days by default (three times the 30-day stale device setting). The check fails when 10 per cent or more of device records are stale, and warns when there are some but fewer than 10 per cent.
Stale records distort every device figure: compliance rates, encryption coverage, operating system counts and the number of devices to replace. They also hide the devices that genuinely stopped reporting, such as a laptop with a broken Intune agent, and an enabled record for a device that has left the organisation can still be used to sign in if the hardware was never wiped.
Why it matters
Stale device objects inflate licence and compliance reporting and can leave valid certificates on decommissioned hardware. They also hide the devices that genuinely stopped reporting.
A typical case: a 100-person firm preparing for Cyber Essentials Plus counts 240 device records for 100 staff. The assessor’s sample includes laptops returned two years earlier, the firm spends days proving which devices are real, and one sampled laptop turns out to have been sold without being wiped, still registered to the tenant.
Cleaning up is quick, and disabling records before deleting them keeps the change reversible. A device clean-up rule then keeps the inventory accurate without anyone remembering to do it.
ISO 27001 A.5.9 (inventory of information and other associated assets), CIS Controls v8 safeguard 1.1 (detailed enterprise asset inventory), the NCSC 10 Steps asset management guidance and the NCSC CAF asset management outcome all expect an accurate inventory of devices.
How to fix it
Where: Intune admin centre → Devices → Device cleanup rules
Before you start
- Check the listed devices are really gone (lost, replaced or wiped) and not just switched off for a long absence.
Step by step
- Export the stale devices. In the Microsoft Entra admin centre, go to Entra ID > Devices > All devices, filter on Activity to show devices with no activity since a date 90 days ago, and select Download devices. In the Microsoft Intune admin centre, Devices > All devices, sort by Last check-in for the Intune view. Compare both with the examples in the evidence.
- Check what each device is. Confirm with the client that the listed devices are gone (returned, replaced, lost or wiped) rather than switched off during long leave. Leave Windows Autopilot devices’ Entra records alone, because they are needed to re-provision the hardware, and remember that hybrid joined devices must be removed from on-premises Active Directory or the next sync recreates them.
- Save BitLocker keys you may still need. Deleting a device record in Entra ID deletes the BitLocker recovery keys stored on it. For any device whose disk might still need unlocking (for example a laptop in storage), copy the key first from Entra ID > Devices > the device > BitLocker keys, or from Intune > the device > Recovery keys.
- Disable the stale records. Select the stale devices in Entra ID > Devices > All devices and choose Disable. Or in Microsoft Graph PowerShell: Connect-MgGraph -Scopes Device.ReadWrite.All; $cutoff = (Get-Date).AddDays(-90); Get-MgDevice -All -Property id,displayName,approximateLastSignInDateTime | Where-Object { $_.ApproximateLastSignInDateTime -and $_.ApproximateLastSignInDateTime -lt $cutoff } | ForEach-Object { Update-MgDevice -DeviceId $_.Id -BodyParameter @{ accountEnabled = $false } }. Run it first without the ForEach-Object part to review the list.
- Delete them after a waiting period. After 30 days with no complaints, delete the disabled records (select them and choose Delete, or Remove-MgDevice -DeviceId <object id>). Retire and delete the matching devices in Intune as well (Devices > All devices > the device > Retire, then Delete).
- Set an Intune device clean-up rule. In the Microsoft Intune admin centre, open Devices > Device clean-up rules (under Organise devices) and create a rule for each platform that removes devices that have not checked in for 90 days. This removes Intune records automatically; Entra ID records still need the periodic clean-up above.
- Confirm the stale records are gone. Repeat the 90-day Activity filter in Entra ID > Devices > All devices: only records you chose to keep, such as Windows Autopilot devices, should remain. The finding clears at the next assessment.
What users will notice
None. Removing a stale record does not affect any device in use.
How to confirm it worked
Entra ID and Intune device lists no longer show devices past the stale threshold; set up a device cleanup rule in Intune so it stays that way.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | A3.a Asset management |
| DORA | Art. 8 Identification of ICT assets and information |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | AM-1 Track asset inventory and their risks |
| Zero Trust | Endpoints |
| PCI DSS 4.0.1 | 12.5.1 An inventory of in-scope system components is maintained |
| NIST SP 800-171 | 3.4.1 Establish and maintain baseline configurations and inventories |
| CMMC Level 2 | CM.L2-3.4.1 System Baselining |
| ISO 27001:2022 | A.5.9 Inventory of information and other associated assets |
| CIS Controls v8.1 | 1.1 Establish and maintain a detailed enterprise asset inventory (IG1) |
| NIST CSF 2.0 | ID.AM-01: Inventories of hardware managed by the organization are maintained |
| NCSC 10 Steps | Asset management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Intune device cleanup rules (Microsoft Learn)