Devices are constantly added to Microsoft Entra ID as employees join an organization, sign in from new computers, or register mobile/personal devices for work access. But device records don’t always disappear when physical device is no longer in use. Over time, these unused device objects accumulate and become stale devices. A tenant with large number of devices can quickly become difficult to manage when administrators cannot easily distinguish active devices from devices that haven’t been used for months. In this guide, you will learn how to find stale devices in Microsoft Entra ID.
What are Stale Devices in Microsoft Entra ID
A stale device is generally a device registered in Microsoft Entra ID that hasn’t been used to access cloud applications for a specified period. Microsoft Entra ID doesn’t apply a universal definition such as: A device becomes stale after exactly 90 days. Instead, your organization must determine what inactivity period should classify a device as stale.
For example, you might consider:
- Devices inactive for 30 days as potentially inactive.
- Devices inactive for 90 days as stale.
- Devices inactive for 180 days as ready for cleanup.
- Devices inactive for 365 days as highly likely to be abandoned
The appropriate threshold depends on your organization’s device lifecycle and working patterns. Now, let’s get into how to find and manage inactive devices in Entra ID.
How to Find Stale Devices in the Microsoft Entra
To find stale devices in Microsoft Entra ID, administrators can use either the Microsoft Entra admin center or Microsoft Graph PowerShell. The Microsoft Entra admin center is useful when you need to manually review a smaller number of devices. Microsoft Graph PowerShell is more suitable for large tenants where administrators need to identify hundreds or thousands of inactive device objects.
Before deleting inactive devices, make sure you have the required permissions. To manage and delete devices in Microsoft Entra ID, you must hold an appropriate Microsoft Entra role, such as Cloud Device Administrator, Intune Administrator, or Global Administrator, depending on the device and management scenario.
Method 1: Using the Microsoft Entra Admin Center
The Microsoft Entra admin center provides a graphical interface for reviewing device activity and identifying devices that have not been used recently.
- Sign in to the Microsoft Entra admin center.
- Navigate to the Entra ID > Devices.
- You can use the built-in Stale devices card on the Devices Overview page for quick identification.
- Alternatively, go to the All devices page, select the Activity filter, and specify a date range to identify inactive devices in the Microsoft Entra admin center.
From that page, you can also select the stale devices and click Disable. Wait a grace period (e.g., 30 days) to ensure no active users are impacted before clicking Delete.
Method 2: Using Microsoft Graph PowerShell
If you have a large environment, PowerShell is the most efficient way to identify and remove stale devices. Before proceeding, make sure you connect to Microsoft Graph PowerShell module.
Connect-MgGraph -Scopes "Device.ReadWrite.All" The Device.ReadWrite.All permission allows the session to read and update device information. Depending on your tenant configuration, administrator consent may be required for this permission.
To find all devices that haven’t logged in for the last 6 months, run the following.
$dt = (Get-Date).AddMonths(-6)
Get-MgDevice -All | Where-Object { $_.ApproximateLastSignInDateTime -le $dt } | Select-Object DisplayName, DeviceId, ApproximateLastSignInDateTime, AccountEnabled The output displays the device name, device ID, approximate last sign-in date, and current account status. Administrators can use this information to review inactive devices and determine whether they should be disabled or investigated further.
To automatically disable devices that fit your stale criteria, you can pipe the cmdlet like below.
$dt = (Get-Date).AddMonths(-6)
$staleDevices = Get-MgDevice -All | Where-Object { $_.ApproximateLastSignInDateTime -le $dt -and $_.AccountEnabled -eq $true }
foreach ($device in $staleDevices) {
Update-MgDevice -DeviceId $device.Id -AccountEnabled $false
}This script changes the AccountEnabled property of each stale device to $false. The device object remains in Microsoft Entra ID, but the disabled device can no longer authenticate through Microsoft Entra ID.
Critical Precautions Before Deleting Stale Devices in Entra ID
The following are the important points to consider before deleting inactive Entra ID devices.
- Deleting a Windows physical device permanently deletes its stored BitLocker keys. Verify that you have backed up keys elsewhere before processing removals.
- Devices deployed via Windows Autopilot or managed via Microsoft Intune cannot be deleted directly from the Entra ID blade until they are retired or deleted from their primary management portal first.
- Microsoft recommends disabling target stale devices first (accountEnabled = $false) for 30 days before executing a permanent delete script. This prevents permanent accidents if an employee returns from a long leave of absence.
Regularly identifying stale devices helps maintain a clean and manageable Microsoft Entra ID environment. Whether you use the Microsoft Entra admin center or Microsoft Graph PowerShell, always review and disable inactive devices before permanently deleting them to avoid impacting legitimate users.
