When an employee leaves, disabling their account and removing licenses are usually high on the offboarding checklist. But there is another question IT needs to answer: What happens to the devices they were using? The employee may have a company laptop that needs to be returned and given to someone else. They may also have a personal phone enrolled in Intune. Or there may be an old device still sitting in Intune even though the employee left months ago. Simply disabling the user account does not resolve any of these situations.
Here is what IT should check when handling Intune-managed devices during employee offboarding.
1. Audit the User’s Device Footprint in Microsoft Intune
Before triggering any destructive actions, IT must establish a clear picture of the departing employee’s digital footprint. The first step is identifying Intune-managed devices mapped to the departing user’s identity.
- Sign in to the Microsoft Intune admin center.
- Navigate to Users > All Users.
- Search for and click on the departing employee’s name.
- From the left-hand navigation menu under “Monitor”, click on Devices.
- Review the inventory table presented on the screen.
Pay attention to the device name, Primary user, ownership, operating system, serial number, and last check-in. This helps confirm which devices actually need attention during offboarding.
Find the User’s Intune Devices Using PowerShell
You can also use Microsoft Graph PowerShell to retrieve the user’s managed devices. Before running the PowerShell commands, connect to Microsoft Graph with the permissions required for your chosen actions.
| Action | Minimum Microsoft Graph Scope |
|---|---|
| Find Intune devices and check ownership | DeviceManagementManagedDevices.Read.All |
| Retire or wipe a device | DeviceManagementManagedDevices.PrivilegedOperations.All |
| View Windows Autopilot registrations | DeviceManagementServiceConfig.Read.All |
| Remove a Windows Autopilot registration | DeviceManagementServiceConfig.ReadWrite.All |
To perform all the PowerShell actions covered in this guide, connect with the following scopes.
Connect-MgGraph -Scopes @(
"DeviceManagementManagedDevices.Read.All"
"DeviceManagementManagedDevices.PrivilegedOperations.All"
"DeviceManagementServiceConfig.ReadWrite.All"
)Then run the below to find the Intune devices mapped to the user.
Get-MgDeviceManagementManagedDevice -All |
Where-Object UserPrincipalName -eq "user@contoso.com" |
Select-Object DeviceName, Id, SerialNumber, OperatingSystem, ManagedDeviceOwnerType, LastSyncDateTime This provides a quick inventory of the user’s Intune devices, including their ownership and last synchronization time.
The Primary user is particularly useful because it shows the user primarily associated with an Intune device. Next, check the device ownership.
2. Check Whether the Device Is Corporate or Personal
Intune can classify enrolled devices as Corporate or Personal, and this distinction can completely change what IT should do next.
For a company-owned device, you might need to recover it, reset it, and prepare it for another employee.
For a personal device, the goal is usually different. You may only need to remove company-managed data and configurations while leaving the employee’s personal information untouched.
You can also check the ownership returned by PowerShell.
Get-MgDeviceManagementManagedDevice -All |
Select-Object DeviceName, UserPrincipalName, ManagedDeviceOwnerType 3. Choose What Happens to the Device
Once you know who owns the device and what will happen to it after the employee leaves, the next step is choosing the right Intune action.
This is an important decision. A company laptop being prepared for another employee should not be handled the same way as a personal phone that the departing employee is taking with them. In most offboarding scenarios, the choice comes down to Retire, Wipe, or Autopilot Reset.
| Action | What Happens | When It Makes Sense |
|---|---|---|
| Retire | Removes Intune-managed company data, apps, settings, and profiles while preserving personal data. | The employee is leaving with a personal/BYOD device, and only organizational data needs to be removed. |
| Wipe | Resets the device and removes user data, apps, and settings. | A company-owned device has been returned and needs a clean start before reuse, storage, or disposal. |
| Autopilot Reset | Removes user files, apps, and settings while keeping the Windows device connected to Microsoft Entra ID and Intune. | An eligible corporate Windows device is staying in the organization and needs to be prepared for another user. |
How to Perform Remove Data Action in Intune
Once the appropriate action has been decided, do the following in the Intune admin center.
- Sign in to the Microsoft Intune admin center.
- Go to Devices > All devices.
- Search for and select the employee’s device.
- Select Remove data dropdown and choose the required action from the device toolbar.
From here, the action depends on what is happening to the device.
If it is a personal device: Select Retire to remove organizational management and company-managed data while leaving the employee’s personal content intact. Run this cmdlet to retire a device using PowerShell.
Invoke-MgRetireDeviceManagementManagedDevice `
-ManagedDeviceId $IntuneDevice.Id This sends the Retire action to the selected Intune-managed device.
If it is a corporate device that needs a clean reset: Select Wipe and review the available wipe options carefully before confirming the action. Wipe a Device Using PowerShell by running the below cmdlet.
Invoke-MgWipeDeviceManagementManagedDevice `
-ManagedDeviceId $IntuneDevice.Id If the scenario requires supported user data to be retained:
Invoke-MgWipeDeviceManagementManagedDevice `
-ManagedDeviceId $IntuneDevice.Id `
-KeepUserData:$true For supported devices where the existing eSIM data plan should remain:
Invoke-MgWipeDeviceManagementManagedDevice `
-ManagedDeviceId $IntuneDevice.Id `
-KeepEsimDataPlan:$true If it is an eligible Windows device being prepared for another employee: Select Autopilot Reset. This removes the previous user’s data and settings while keeping the device enrolled and ready for reuse within the organization.
Make sure any business data that exists only on the device has been preserved. These actions can remove data that may not be recoverable afterward. The key is not to choose an action simply because the employee is leaving. Choose it based on who owns the device and what is going to happen to the device next.
4. Complete the Cleanup When a Device Leaves the Organization
Wiping or retiring a device may not always be the final step. If a company-owned device is being sold, recycled, returned to a leasing company, or permanently removed from the organization, check whether it also needs to be removed from Windows Autopilot and Microsoft Entra ID.
This is different from a device that is simply being reassigned internally. If the laptop is staying within the organization, its Autopilot registration will normally still be useful.
Remove the Device from Windows Autopilot
A device that permanently leaves the organization should be deregistered from Windows Autopilot so that it is no longer associated with your organization’s Autopilot deployment service. Microsoft recommends deleting the device from Intune before deregistering it from Autopilot.
To deregister an Autopilot device in Intune, do the following.
- In the Microsoft Intune admin center, first locate the device under Devices > Windows and delete its Intune device record.
- Make a note of the device’s serial number.
- Go to Devices > Windows > Enrollment.
- Under Windows Autopilot, select Devices.
- Find the device using its serial number.
- Select the device and choose Delete.
Find the Autopilot Device Using PowerShell
You can retrieve Windows Autopilot registrations with:
Get-MgDeviceManagementWindowsAutopilotDeviceIdentity -All |
Select-Object Id, SerialNumber, Model, Manufacturer,
GroupTag, ManagedDeviceId To locate a specific device:
$autopilotDevice = Get-MgDeviceManagementWindowsAutopilotDeviceIdentity -All |
Where-Object SerialNumber -eq "SERIAL-NUMBER" This finds the Autopilot registration that matches the device’s serial number.
Remove the Autopilot Registration Using PowerShell
You can remove Windows Autopilot registrations with:
Remove-MgDeviceManagementWindowsAutopilotDeviceIdentity `
-WindowsAutopilotDeviceIdentityId $autopilotDevice.Id This removes the device’s Windows Autopilot registration and should be used when the device is permanently leaving the organization, rather than when it is simply being reassigned to another employee.
This step is generally needed when the device is permanently leaving the organization, not when it is simply being prepared for another employee.
What About the Microsoft Entra Device?
There may also be a corresponding device object in Microsoft Entra ID. However, don’t automatically delete every Entra device object during offboarding. Microsoft specifically recommends caution here. Deleting an Entra device is nonrecoverable and can also remove information associated with it, such as BitLocker recovery keys. For Autopilot devices, manually deleting the Entra object at the wrong point can also cause enrollment problems.
If the device is permanently leaving the environment and its Entra record is no longer required, it can be reviewed under: Microsoft Entra admin center > Devices > All devices.
5. Check for Devices Associated with Former Employees
Device cleanup shouldn’t stop with the employee currently being offboarded. It is also worth checking whether devices from previously departed employees are still sitting in Intune.
For example, a laptop may have been reassigned without updating its Primary user, or an old device may still appear even though it hasn’t checked in for months. Reviewing the Primary user and Last check-in can help identify these forgotten devices and determine whether they still belong in your environment.
Use Device Cleanup Rules for Stale Devices
Intune also provides Device cleanup rules to automatically hide devices that haven’t checked in for a specified period.
- Go to Devices > Device cleanup rules.
- Select the platform and define the number of inactive days. Intune supports a range of 30 to 270 days.
Note: Cleanup rules only hide stale devices from Intune views and reports. They don’t wipe or retire the device, and they don’t remove its Microsoft Entra device object.
Regularly reviewing these stale and former-user devices helps keep your Intune inventory accurate and easier to manage!
