Three device registries, no synchronization

Open the device list in Entra ID at a company that has run Microsoft 365 for five years. Count the number of devices. Compare it with the number of employees. The difference is rarely below 30 percent, and at companies that have been through an acquisition or a large hardware rollout it is often above 100 percent.

The explanation is simple and structural: a Windows device exists in three independent registries, and none of them automatically cleans up the other two.

The three registries

1. Microsoft Entra ID — the device object, with deviceId, join type (Entra joined, hybrid joined, registered), owner and ApproximateLastSignInDateTime.

2. Microsoft Intune — the MDM device record, with compliance status, check-in time and policy assignments.

3. Windows Autopilot deployment service — the hardware registration, tied to the hardware hash, which determines what happens the next time the machine is wiped and restarted.

A device can exist in all three, in two of three, or in one — and each combination has its own failure mode.

Entra ID has no automatic cleanup

There is no built-in function in Entra ID that removes stale devices. Microsoft documents a manual, script-based process in three phases:

• Detect — find devices where ApproximateLastSignInDateTime is older than your threshold.
• Disable — "It isn't advisable to immediately delete a device that appears to be stale because you can't undo a deletion if there's a false positive. As a best practice, disable a device for a grace period before deleting it." Microsoft's own example: disable after 90 days.
• Delete — delete after the grace period, in the example 120 days disabled.

Two caveats make this process more demanding than it looks:

The activity timestamp is not real time. It is updated only when the difference is greater than 14 days, with ±5 days of variation. So you cannot use it to answer "was this machine in use last week".

And: "Some active devices may have a blank time stamp." A blank field does not mean a stale device. A cleanup script that treats null as "old" deletes active machines.

Intune's cleanup rules hide, they do not delete

Intune has device cleanup rules, and they are routinely misunderstood. Microsoft's wording: the rules "run on a schedule and automatically hide records of devices that didn't check in for a specified period". They "don't trigger any actions on the device (no wipe or retire)".

The interval is configured between 30 and 270 days. The rule has to be created manually — it is not preconfigured.

The decisive point: "Devices hidden from Intune aren't removed from Microsoft Entra ID." So you can have a device list in Intune that looks tidy, while the Entra directory still carries the entire backlog. A hidden device can also reappear if it checks in before the device certificate expires.

Autopilot is the one that really bites

This is where the most expensive mistake sits, because it is irreversible in practice.

Deleting a device from Intune or from Entra ID does not remove the Autopilot registration. And the other way around: "Deregistering a device from Windows Autopilot removes the device's registration from the Windows Autopilot deployment service. However, this action doesn't always remove the corresponding Microsoft Entra device object."

The correct order is documented: delete from Intune first, then deregister from Windows Autopilot. The effect of the deregistration depends on MDM status — if the device is not enrolled in MDM, the deregistration may also remove the Entra object; if it is enrolled now or has been, the Entra object is not deleted automatically.

Microsoft warns explicitly: "Avoid manually deleting the device from Microsoft Entra ID, as this can cause unexpected issues." The wrong order can produce orphaned registrations that require Microsoft support to fix.

The practical consequence in business: a machine that is sold on or returned at the end of a lease, but that is still registered in your Autopilot tenant, will try to enroll with you the next time it is reset — at a new owner.

Why this is not just tidiness

• Security. An active device object can be subject to Conditional Access evaluations. Microsoft's own offboarding procedure includes a separate step to disable the user's registered devices, precisely because account deactivation does not do it.
• License and cost. Device-based licensing and Intune seats are not calculated for free.
• Compliance figures. The compliance percentage in the Intune report is meaningless when the denominator contains 400 machines that were scrapped in 2023.
• Investigation. During an incident, time spent working out whether DESKTOP-4KJ2L1 still exists physically is time you do not have.

What this means for Entra Logic

This is a classic task for continuous synchronization rather than periodic scripts. Entra Logic's synchronization service keeps an up-to-date, searchable copy of the estate — including devices, Intune records and Autopilot registrations — in one surface. Orphaned devices and unowned Autopilot registrations surface automatically as a short work list, instead of accumulating as a backlog until someone has time.

And the most important operational point: cleanup happens as an approved order with the correct sequence built in — a request that carries its own approval and execution — not as a freehand script an administrator runs under time pressure. The order Intune → Autopilot → Entra is not something the individual has to remember; it is a property of the operation.

For a group or a managed service provider with many tenants, this applies per tenant, in the same working surface, with the same traceability — instead of three consoles times the number of customers.

—

Sources

• Microsoft Learn — How To: Manage stale devices in Microsoft Entra ID
• Microsoft Learn — Automatically delete devices with cleanup rules
• Microsoft Learn — Windows Autopilot registration overview
• Microsoft Learn — Revoke user access in Microsoft Entra ID