Intune Stale Device Audit

Read-only PowerShell script that finds stale Intune and Entra devices, duplicate records from re-enrolment, and flags BitLocker keys and Autopilot before you delete.

Send me the scriptView on GitHub

What it does

  • Reads every Intune managed device and every Entra ID device through Microsoft Graph, with your own account, and matches them up
  • Flags devices with no Intune check-in for $StaleDays days (90 by default), and Entra-only devices that have gone quiet
  • Marks devices that stopped syncing with Intune but still sign in to Entra as Check: in use with a broken enrolment, not lost
  • Finds duplicate records left behind when the same hardware re-enrols, by serial number
  • Counts the BitLocker recovery keys Entra holds for each flagged device (key IDs only), and flags Autopilot and hybrid joined devices, so you know what deleting would cost
  • Exports a CSV with a next step per device and exits 1 when anything is flagged, so it can run on a schedule
  • Read-only: it deletes, disables and retires nothing

Configuration

You edit one block:

PowerShell
Preview snippet. The full, tested script lives in the vault.
# ===== CONFIG =====
$OutputPath         = Join-Path $env:USERPROFILE 'Desktop\Atliso-StaleDevices.csv'
$StaleDays          = 90     # no Intune check-in (or Entra sign-in) for this many days
$CheckBitLockerKeys = $true  # count recovery keys in Entra: deleting the device deletes them
$CheckAutopilot     = $true  # flag Autopilot devices: deleting their Entra object breaks reuse
$LogPath            = Join-Path $env:LOCALAPPDATA 'Atliso\StaleDeviceAudit.log'
# ==================

Run it

It runs on your own workstation, not on devices, with Windows PowerShell 5.1 or PowerShell 7:

PowerShell
Preview snippet. The full, tested script lives in the vault.
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
Install-Script Atliso-StaleDeviceAudit -Scope CurrentUser   # from the PowerShell Gallery
Atliso-StaleDeviceAudit.ps1
# MSPs: run once per customer tenant
Atliso-StaleDeviceAudit.ps1 -TenantId contoso.onmicrosoft.com

Full walkthrough, including the safe order to clean up Intune and Entra: Intune stale devices: clean up without losing BitLocker keys

Get Intune Stale Device Audit

We'll send the script, and updates when Microsoft changes how device cleanup works. No spam.