How to find stale devices in Microsoft Entra ID

Before you start

Reading devices needs no administrator role: any member of the tenant can view and download the device list, and Directory Readers and Global Reader work too. The PowerShell example requests Device.Read.All; your organisation may require administrator consent.

Know what the timestamp records. Entra ID sets it when a device authenticates: a joined or hybrid joined Windows device active on the network, an Intune device checking in, or a Conditional Access policy that asks for a managed device. The examples read and export; they do not disable or delete any device.

Option 1

Find stale devices with PowerShell

Install the modules once, then connect and export the enabled devices with no activity in the last 180 days. The date filter runs in Microsoft Graph, so only the older devices come back.

# Install once, if the modules are not already installed.
$modules = 'Microsoft.Graph.Authentication', 'Microsoft.Graph.Identity.DirectoryManagement'
Install-Module $modules -Scope CurrentUser

$ErrorActionPreference = 'Stop'
$days = 180
$cutoff = (Get-Date).ToUniversalTime().AddDays(-$days).ToString('yyyy-MM-ddTHH:mm:ssZ')
Connect-MgGraph -Scopes 'Device.Read.All' -NoWelcome
try {
    $joinTypes = @{
        AzureAd   = 'Entra joined'
        ServerAd  = 'Hybrid joined'
        Workplace = 'Entra registered'
    }
    $properties = 'id', 'deviceId', 'displayName', 'accountEnabled', 'operatingSystem',
        'operatingSystemVersion', 'trustType', 'isManaged', 'approximateLastSignInDateTime'
    $filter = "approximateLastSignInDateTime le $cutoff"
    $stale = @(Get-MgDevice -All -Filter $filter -Property $properties |
        Where-Object { $_.AccountEnabled } | Sort-Object ApproximateLastSignInDateTime)
    $report = @(foreach ($device in $stale) {
        $joinType = $joinTypes[[string]$device.TrustType]
        if (-not $joinType) { $joinType = $device.TrustType }
        [pscustomobject]@{
            Device       = $device.DisplayName
            OS           = $device.OperatingSystem
            Version      = $device.OperatingSystemVersion
            JoinType     = $joinType
            Managed      = $device.IsManaged
            LastActivity = $device.ApproximateLastSignInDateTime
            DeviceId     = $device.DeviceId
        }
    })
    if ($report.Count -eq 0) {
        Write-Output "No enabled device has been inactive for $days days."
    } else {
        $report | Export-Csv -Path './stale-entra-devices.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) enabled devices have had no activity for $days days."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The script keeps enabled devices, longest silent first, with the join type in the admin centre's words. Managed is true for a device an MDM such as Intune manages. A device with no timestamp doesn't match the filter, so it is left out. Change $days for another cutoff.

Check 1 device

Reconnect with Connect-MgGraph, then read 1 device by its name. 2 objects with the same name are often 1 device registered twice.

# Run while connected to Microsoft Graph. Replace the example device name.
$properties = 'displayName', 'accountEnabled', 'trustType', 'approximateLastSignInDateTime'
Get-MgDevice -Filter "displayName eq 'CONTOSO-PC01'" -Property $properties |
    Select-Object DisplayName, AccountEnabled, TrustType, ApproximateLastSignInDateTime

Option 2

Review stale devices in the admin centre

1. Sign in to the Microsoft Entra admin centre for the correct tenant.
2. Go to Entra ID > Devices > All devices.
3. Filter the list on Enabled state and Activity timestamp to show the enabled devices with no activity since your cutoff.
4. Read the Activity column for each device, and select a device to see its details. Leave each device as it is.
5. To keep the list, select Download devices. The CSV holds the devices the filters show.

This suits a one-off look at a tenant you already have open. For a list you can compare month to month, use PowerShell or a report.

Common questions

Should I delete a stale device straight away?

No. Microsoft advises disabling it for a grace period first, as a deletion can't be undone. Retire an Intune device in Intune before anything else, and leave Autopilot devices alone: once deleted they can't be reprovisioned. Deleting a device also deletes the BitLocker keys stored on it.

Why does a device in daily use look stale?

The timestamp moves only when it is more than about 14 days old, so it is never exact, and some active devices have none. The owner may also be on leave longer than your cutoff. Check with the owner before you disable anything.

How is this different from stale devices in Intune?

Intune records when a device last synced with Intune; Entra ID records when the device object last authenticated. A device can be stale in 1 and not the other. For Intune's side, see how to find stale devices in Intune.