Configure an Intune cleanup rule for inactive devices

Description

An Intune device cleanup rule (platform All platforms, or one rule per platform in use) hides devices that have not checked in for {{ device_cleanup_days }} days or less. The Microsoft Entra device objects of the same devices are reviewed and disabled, then deleted, by a separate stale device process.

Rationale

An inventory full of retired, lost or reimaged devices skews compliance reports and makes it harder to spot devices that should be investigated. Stale records also keep old device certificates and identities usable longer than needed. A cleanup rule keeps the Intune view limited to devices that are actually managed.

Impact

Hidden devices disappear from Intune views and reports; no wipe or retire action is sent. A hidden device that checks in again before its management certificate expires reappears; afterwards it must re-enroll. Devices that are offline for long periods by design (spare stock, seasonal workers) need a longer threshold or a dedicated process. The rule does not delete Microsoft Entra device objects.

Applies when

Requires: Microsoft Intune

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Intune admin center (https://intune.microsoft.com) as at least a Global Reader.
2. Browse to Devices > Organize devices > Device cleanup rules.
3. Check that a rule exists for All platforms, or for each platform in use, and that Remove devices that haven't checked in for this many days is {{ device_cleanup_days }} or less. When both exist, the rule with fewer days applies.
4. Alternative, read only: Invoke-MgGraphRequest -Method GET -Uri https://graph.microsoft.com/beta/deviceManagement/managedDeviceCleanupRules (scope DeviceManagementManagedDevices.Read.All).
5. Fail if no rule exists, or if the effective threshold for a platform in use is above {{ device_cleanup_days }} days.

Remediation

1. In the Intune admin center, browse to Devices > Organize devices > Device cleanup rules > Create. Role: Intune Administrator, or a custom role with Managed Device Cleanup Rules/Update and Managed Device Cleanup Settings/Update.
2. Enter a name, choose All platforms (or a platform), and select Next.
3. Set Remove devices that haven't checked in for this many days to {{ device_cleanup_days }}. Use Preview affected devices to check the list, then create the rule.
4. Handle Microsoft Entra device objects separately: in Entra ID > Devices > All devices, filter on Activity older than the same period, disable the devices, and delete them after a grace period (keep BitLocker and LAPS secrets you still need).

Rollback

Delete the cleanup rule. Hidden devices reappear when they check in again.

References

• Automatically hide devices with cleanup rules Microsoft, vendor-doc, accessed 2026-10-24
• Maester test MT.1053 Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-DEVICE-001 Mark devices without a compliance policy as not compliant
• related CB-M365-DEVICE-004 Limit the number of devices each user can join or register

People and lifecycle