How to find stale devices in Microsoft Intune

Before you start

Use an account that can read Intune devices, such as one in the Read Only Operator role, which cannot change Intune. The tenant needs an active Intune licence. The PowerShell example requests DeviceManagementManagedDevices.Read.All; your organisation may require administrator consent.

The list covers devices enrolled in Intune, and leaves out any that a device cleanup rule has hidden. The examples read and export; they do not retire, wipe, hide or delete any device.

Option 1

Find stale devices with PowerShell

Install the modules once, then connect and export the managed devices that last synced before the cutoff. The filter runs in Microsoft Graph, so only those devices come back.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.DeviceManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
$days = 90
$now = (Get-Date).ToUniversalTime()
$limit = $now.AddDays(-$days)
$cutoff = $limit.ToString('yyyy-MM-ddTHH:mm:ssZ', [cultureinfo]::InvariantCulture)
Connect-MgGraph -Scopes 'DeviceManagementManagedDevices.Read.All' -NoWelcome
try {
    $filter = "lastSyncDateTime lt $cutoff"
    $properties = 'id', 'deviceName', 'userPrincipalName', 'operatingSystem', 'osVersion',
        'complianceState', 'managedDeviceOwnerType', 'enrolledDateTime', 'lastSyncDateTime'
    $devices = Get-MgDeviceManagementManagedDevice -All -Filter $filter -Property $properties
    $report = @(foreach ($device in $devices) {
        $lastSync = $device.LastSyncDateTime.ToUniversalTime()
        [pscustomobject]@{
            DeviceName       = $device.DeviceName
            User             = $device.UserPrincipalName
            OperatingSystem  = $device.OperatingSystem
            OsVersion        = $device.OsVersion
            ComplianceState  = $device.ComplianceState
            Ownership        = $device.ManagedDeviceOwnerType
            EnrolledDateTime = $device.EnrolledDateTime
            LastSyncDateTime = $lastSync
            DaysSinceSync    = [int][math]::Floor(($now - $lastSync).TotalDays)
            Id               = $device.Id
        }
    })
    if ($report.Count -eq 0) {
        Write-Output "No managed devices last synced more than $days days ago."
    } else {
        $report | Sort-Object LastSyncDateTime |
            Export-Csv -Path './stale-devices.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) managed devices last synced more than $days days ago."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The script keeps every platform and ownership type, oldest sync first. DaysSinceSync counts whole days to the moment the script ran. Set $days to 30 for a tighter list. To keep 1 platform, filter on OperatingSystem with Where-Object after the read.

Option 2

Review last check-in in the admin centre

1. Sign in to the Microsoft Intune admin centre for the correct tenant.
2. Go to Devices > All devices.
3. Check that the Last check-in column is showing, or add it with Columns.
4. Select the Last check-in heading to sort, and again to reverse, so the oldest date is at the top.
5. Read each date against your cutoff, and select a device for its details. Leave without changing anything.

This suits a quick look at a tenant you already have open. For a list to keep and compare from month to month, use PowerShell or a report.

Common questions

Does a stale device mean the device is gone?

No. The date is the last successful sync, so a laptop in a drawer, an owner on long leave and a device that lost its enrolment look alike. Ask the owner before you retire a device. A device deleted from Microsoft Entra ID cannot be recovered, and neither can its BitLocker recovery keys.

Can Intune hide stale devices for me?

Yes. Device cleanup rules, under Devices > Device cleanup rules, hide devices that have not checked in for 30 to 270 days. They do not wipe or retire a device, and the device stays in Microsoft Entra ID. Creating a rule changes the tenant and needs the Intune Administrator role or a custom role with the cleanup permissions.

Why is a stale device also non-compliant?

Intune's default compliance policy marks a device non-compliant when it stays out of contact with Intune; the default grace period is 30 days. To see the reasons for each device, see how to find non-compliant devices.