Intune Device Cleanup Rules: Hide the Ghosts Before They Haunt Your Reports

Intune device cleanup rules are the closest thing Microsoft Intune has to a loft clearance. Every tenant collects junk: the laptop Dave from accounts left on a train in 2023, a test VM nobody admits to building, and three iPads that went home with leavers and never came back.

They all sit in All devices, dragging down your compliance numbers and making the helpdesk guess which of four devices called DESKTOP-7F3K2 is the real one. Intune device cleanup rules hide those ghosts automatically once they stop checking in, without wiping, retiring or deleting anything.

This guide covers how to set up Intune device cleanup rules properly (including the Rule settings step I somehow left empty the first time), how to prove what was hidden with the Intune audit logs, and how to deal with the separate pile of stale devices in Microsoft Entra ID.

Never miss a guide: subscribe here and check out my YouTube channel.

Prefer to watch? I walk through Intune device cleanup rules for Windows, iOS, Android and macOS in this video.

What are Intune device cleanup rules?

Intune device cleanup rules are scheduled rules that hide device records which haven’t checked in with Intune for a set number of days. They run every 24 hours, and if a hidden device checks in again it carries on as an enrolled device without you lifting a finger.

Think of it as moving old paperwork into a box in the garage rather than having a bonfire. The device vanishes from the Intune admin centre and reports, but nothing is sent to the device and nothing is removed from Microsoft Entra ID.

Intune device cleanup rules do	Intune device cleanup rules don’t
Hide stale devices from the Intune admin centre and reports	Wipe, retire or send any command to the device
Run automatically every 24 hours	Delete the Microsoft Entra ID device object
Let a hidden device reappear if it checks in before its certificate expires	Touch Autopilot registrations or BitLocker recovery keys
Write an audit log entry for every device they hide	Apply to Jamf-managed devices

Why bother with Intune device cleanup rules?

Stale records make everything slightly worse, and Intune device cleanup rules are the cheapest fix. Duplicate devices after a reimage confuse the helpdesk, device counts stop matching reality, and every report needs a mental footnote saying “ignore the dead ones”.

There’s a compliance angle too. By default Intune treats a device that hasn’t reported compliance for 30 days as noncompliant, through the Compliance status validity period (configurable from 1 to 120 days). So your ghosts are probably already sitting in the noncompliant report, making your numbers look worse than they are.

And left alone, they hang around for ages. The MDM certificate lasts a year and renews while the device keeps checking in, and Intune only removes idle records 180 days after that certificate expires. That’s well over a year of a dead laptop loitering in your console.

Before you start

What you need	Why
Intune Administrator role (called Intune Service Administrator in Microsoft Graph and PowerShell)	Can create and edit Intune device cleanup rules
Or a custom Intune role with Managed Device Cleanup Rules/Update and Managed Device Cleanup Settings/Update, plus read access such as Organization/Read and Managed devices/Read	The least-privilege option for whoever owns housekeeping
Cloud Device Administrator or Intune Administrator in Microsoft Entra ID	To disable or delete stale Entra device objects
Microsoft Graph PowerShell SDK	For the stale device report and clean-up scripts later on
A list of devices that must never disappear	Kiosks, exam-hall laptops and shelf spares, to check against the preview list

How to set up Intune device cleanup rules in 7 steps

Step 1: Give yourself the right role

Option one is the built-in Intune Administrator role in Microsoft Entra ID:

1. Sign in to the Microsoft Entra admin centre as at least a Privileged Role Administrator.
2. Go to Entra ID > Roles & admins and search for Intune Administrator.
3. Open the role and select Add assignments.
4. Pick the user or group, then select Add. If you use Microsoft Entra PIM, make the assignment eligible rather than permanent.

Option two is a custom role. In the Intune admin centre go to Tenant administration > Roles > All roles > Create, add the two Managed Device Cleanup permissions plus the read permissions from the table above, and assign it to a group.

Step 2: Find Intune device cleanup rules in the admin centre

1. Sign in to the Microsoft Intune admin centre.
2. Select Devices, then scroll to the Organize devices heading and select Device cleanup rules.
3. Select Create.

The first version of this guide said Devices > Device cleanup rules. It now sits under Organize devices, a few scrolls down the Devices menu, next to Assignment filters.

Step 3: Fill in the Basics

• Name: something you’ll understand at 4:55pm on a Friday, such as Cleanup Windows 60 days.
• Description: optional, but future you will appreciate it.
• Platform: pick one from the list below.

The platform options are All platforms, Android (AOSP), Android (fully managed/dedicated/corporate-owned work profile), Android (device administrator), Android (personally-owned work profile), ChromeOS, iOS/iPadOS, macOS, Windows, Windows Holographic, visionOS and tvOS.

Step 4: Configure the Rule settings

This is the step the original article left blank, which is a bit like a recipe that just says “add the ingredients”. It is also the setting that makes Intune device cleanup rules useful at all.

Rule settings has one field: Remove devices that haven’t checked in for this many days. Enter a number between 30 and 270. Despite the word “remove”, the device is hidden, not deleted.

Before you select Next, select Preview affected devices. It lists every device that hasn’t checked in within your window, which is your chance to spot the boardroom PC that only gets switched on for the AGM.

Example scenario: a sensible starting point for a mixed estate might look like this. Adjust it for how your organisation actually works.

Platform	Example threshold	Reasoning
Windows	90 days	Covers long holidays and sickness absence without keeping dead kit forever
iOS/iPadOS	60 days	Phones check in constantly, so a long silence usually means a drawer or a dead battery
Android (personally-owned work profile)	60 days	Personal phones get replaced without anyone telling IT
macOS	120 days	Smaller fleets, often travelling, and nobody wants to chase the design team
All platforms	Leave it out, or set it longer than every platform rule	So it never overrides a platform-specific threshold

Step 5: Review and create

1. Select Next to reach Review + create.
2. Check the platform and the number of days. Then check them again.
3. Select Create.

The rule is saved, and Intune device cleanup rules run on a 24-hour schedule, so don’t expect the All devices list to shrink before your tea has gone cold.

Step 6: Check the Intune audit logs

1. Go to Tenant administration > Audit logs.
2. Set the Date range to cover the period since the rule was created.
3. Select Add filters > Category > Device, then Add filters > Activity to narrow it down.
4. Open an entry to see the target device and the properties that changed.

In my lab the entries appeared as Patch ManagedDevice operations, initiated by System, with an activity starting “Device set to be removed from intune reports”. The current Device cleanup rules documentation names the activity Device set to be hidden from admin by Device Cleanup Rule, followed by your rule name, so try both wordings if a search comes back empty.

Every device hidden by Intune device cleanup rules gets its own entry. Need a longer paper trail? Export from the same page, route audit logs to Azure Monitor, or pull up to two years of Intune audit events with Microsoft Graph.

Step 7: Repeat for your other platforms

Intune device cleanup rules work best with one rule per platform, so repeat steps 2 to 6 for each platform you manage.

What happens when a hidden device comes back?

Intune device cleanup rules are forgiving. If a hidden device checks in before its device certificate expires, it reappears in Intune with no re-enrolment, no ticket and no drama.

If the certificate has expired, the device can’t check in, so it has to be re-enrolled to be managed again. There’s no Unhide button: the documented routes back are a check-in or re-enrolment.

Situation	What happens
Hidden device checks in before its certificate expires	Reappears in Intune automatically
Hidden device comes back after the certificate expired	Can’t check in, so re-enrol it
180 days after the MDM certificate expired	Intune removes the record, rule or no rule
Any of the above	The Microsoft Entra ID device object stays until you deal with it

How to clean up stale devices in Microsoft Entra ID

Intune device cleanup rules leave Microsoft Entra ID alone. The device object, its BitLocker recovery keys and its group memberships all stay put, which is why your Entra device list is often twice the size of your Intune one.

Entra spots stale devices with the activity timestamp, ApproximateLastSignInDateTime. It only updates when the change is more than 14 days (give or take 5), so Manage stale devices in Microsoft Entra ID advises never treating anything under 21 days as stale.

Find stale devices in the Microsoft Entra admin centre

1. Sign in to the Microsoft Entra admin centre as at least a Cloud Device Administrator.
2. Go to Entra ID > Devices > All devices.
3. Sort by the Activity column, or select Download devices for a CSV you can filter in Excel.

Find stale devices with Microsoft Graph PowerShell

For more than a handful of devices, PowerShell is quicker. This read-only report exports devices with no activity for 90 days and skips Autopilot devices, which carry a [ZTDID] physical ID.

# Read-only report: Entra ID devices with no activity for 90 days
Connect-MgGraph -Scopes "Device.Read.All"

$cutoff = (Get-Date).AddDays(-90)

$devices = Get-MgDevice -All -Property "Id,DeviceId,DisplayName,OperatingSystem,TrustType,AccountEnabled,ApproximateLastSignInDateTime,PhysicalIds"

$stale = $devices | Where-Object {
    $_.ApproximateLastSignInDateTime -and
    $_.ApproximateLastSignInDateTime -le $cutoff -and
    -not ($_.PhysicalIds -match '\[ZTDID\]')
}

$stale |
    Sort-Object ApproximateLastSignInDateTime |
    Select-Object DisplayName, OperatingSystem, TrustType, AccountEnabled, ApproximateLastSignInDateTime, DeviceId, Id |
    Export-Csv .\stale-entra-devices.csv -NoTypeInformation

"{0} stale devices exported to stale-entra-devices.csv" -f @($stale).Count

Some active devices have a blank timestamp, so the script leaves those out rather than flagging them. Check them by hand before you assume anything.

Disable first, delete later

You can’t undo a hard delete, so disable stale devices for a grace period first. A disabled device can’t authenticate to Microsoft Entra ID, so if it’s still in use, its owner will tell you within the hour.

• Intune-managed devices: retire or delete them in Intune first, then disable them in Entra ID.
• Microsoft Entra hybrid joined devices: disable or delete the computer in on-premises Active Directory and let Microsoft Entra Connect sync the change. Deleting only in Entra ID brings it back as a new object in a Pending state.
• Microsoft Entra joined and registered devices: disable or delete them in Microsoft Entra ID.
• Autopilot devices: deregister them from Autopilot before you delete anything. Deleted system-managed devices can’t be reprovisioned.

This script disables the cloud-managed devices from your reviewed CSV and skips hybrid joined ones. It runs with -WhatIf, so it only tells you what it would do until you remove that switch.

# Disable cloud-managed stale devices from the reviewed CSV
# Hybrid joined devices (TrustType ServerAd) are skipped: handle those in on-premises AD
Connect-MgGraph -Scopes "Directory.AccessAsUser.All"

$params = @{ accountEnabled = $false }

Import-Csv .\stale-entra-devices.csv |
    Where-Object { $_.TrustType -ne "ServerAd" -and $_.AccountEnabled -eq "True" } |
    ForEach-Object {
        Update-MgDevice -DeviceId $_.Id -BodyParameter $params -WhatIf
    }

After your grace period, delete the devices that are still disabled. Again, read the -WhatIf output before you let it loose.

# After the grace period: delete devices that are still disabled and inactive for 120 days
# Back up BitLocker recovery keys first. Remove -WhatIf only when you are happy with the output.
Connect-MgGraph -Scopes "Directory.AccessAsUser.All"

$cutoff = (Get-Date).AddDays(-120)

Get-MgDevice -All -Property "Id,DisplayName,AccountEnabled,ApproximateLastSignInDateTime,PhysicalIds" |
    Where-Object {
        $_.AccountEnabled -eq $false -and
        $_.ApproximateLastSignInDateTime -and
        $_.ApproximateLastSignInDateTime -le $cutoff -and
        -not ($_.PhysicalIds -match '\[ZTDID\]')
    } |
    ForEach-Object { Remove-MgDevice -DeviceId $_.Id -WhatIf }

How to prove your Intune device cleanup rules worked

• Before: note the device count in Devices > All devices and save the Preview affected devices list.
• A day or two later: check the count has dropped by roughly the number in the preview.
• Audit logs: match the entries in Tenant administration > Audit logs against your preview list.
• Spot check: pick one hidden device and find it in Entra ID > Devices > All devices. If it’s still there, the rule hid it rather than deleted it, which is exactly right.

Intune device cleanup rules gotchas

The shorter rule wins. An All platforms rule with fewer days beats any platform rule. Check your All platforms setting before blaming the Windows one.

Remove means hide. The field says “remove devices”, but nothing leaves Microsoft Entra ID, Autopilot or on-premises Active Directory.

No group targeting. Intune device cleanup rules cover every device on a platform, so seasonal or shelf-spare devices set the pace for everyone.

Jamf-managed devices. Cleanup rules don’t apply to them, so Macs managed through Jamf need tidying in Jamf.

Long-term absence. Someone on extended leave can look stale. Short thresholds catch real people, and nobody enjoys explaining that to the head teacher.

Should you use Intune device cleanup rules?

Yes. Intune device cleanup rules take five minutes per platform, they can’t wipe anything, and a device that turns out to be alive comes back on its own.

Start with something like 90 days for Windows and macOS and 60 for mobile, check the preview list, and look at the audit logs the next day. Then spend an hour on the Entra side, because that’s where stale devices keep hold of BitLocker keys and group memberships.

Then put the kettle on. Your All devices list finally fits on one screen, which hasn’t happened since Windows 98.

Intune device cleanup rules FAQs

Further reading

• Device cleanup rules (Microsoft Learn)
• Manage stale devices in Microsoft Entra ID (Microsoft Learn)
• Use audit logs to track and monitor events in Microsoft Intune (Microsoft Learn)
• Device soft delete overview (preview) (Microsoft Learn)
• Create a custom role in Intune (Microsoft Learn)
• Intune Endpoint security: what each blade does
• Intune Remediations: fix problems before users notice
• Intune Endpoint analytics explained

While you’re tidying Intune, my Endpoint security walkthrough is the natural next job:

Found this useful? Buy me a coffee, and if you handle subject access requests, have a look at Redact Ninja for redacting PDFs without sending files to a server.