{
  "id": "CB-M365-DEVICE-010",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-010",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-010.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-010.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-DEVICE-010",
    "title": "Configure an Intune cleanup rule for inactive devices",
    "finding": {
      "title": "No Intune device cleanup rule is configured",
      "description": "Devices that stopped checking in long ago stay in the Intune inventory and reports, hiding the real fleet and keeping stale records around."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "intune",
      "device-lifecycle",
      "inventory",
      "hygiene"
    ],
    "applicability": {
      "requires": [
        "Microsoft Intune"
      ]
    },
    "description": "An Intune device cleanup rule (platform **All platforms**, or one rule per platform in use) hides\ndevices that have not checked in for `{{ device_cleanup_days }}` days or less. The Microsoft\nEntra device objects of the same devices are reviewed and disabled, then deleted, by a separate\nstale device process.\n",
    "rationale": "An inventory full of retired, lost or reimaged devices skews compliance reports and makes it\nharder to spot devices that should be investigated. Stale records also keep old device\ncertificates and identities usable longer than needed. A cleanup rule keeps the Intune view\nlimited to devices that are actually managed.\n",
    "impact": "Hidden devices disappear from Intune views and reports; no wipe or retire action is sent. A\nhidden device that checks in again before its management certificate expires reappears;\nafterwards it must re-enroll. Devices that are offline for long periods by design (spare stock,\nseasonal workers) need a longer threshold or a dedicated process. The rule does not delete\nMicrosoft Entra device objects.\n",
    "parameters": [
      {
        "name": "device_cleanup_days",
        "type": "integer",
        "unit": "days",
        "description": "Highest accepted inactivity period before Intune hides a device.",
        "default": 90,
        "minimum": 30,
        "maximum": 270
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Microsoft Intune admin center (https://intune.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Devices** > **Organize devices** > **Device cleanup rules**.\n3. Check that a rule exists for **All platforms**, or for each platform in use, and that\n   **Remove devices that haven't checked in for this many days** is `{{ device_cleanup_days }}`\n   or less. When both exist, the rule with fewer days applies.\n4. Alternative, read only: `Invoke-MgGraphRequest -Method GET -Uri\n   https://graph.microsoft.com/beta/deviceManagement/managedDeviceCleanupRules` (scope\n   `DeviceManagementManagedDevices.Read.All`).\n5. Fail if no rule exists, or if the effective threshold for a platform in use is above\n   `{{ device_cleanup_days }}` days.\n"
    },
    "remediation": {
      "manual": "1. In the Intune admin center, browse to **Devices** > **Organize devices** > **Device cleanup\n   rules** > **Create**. Role: Intune Administrator, or a custom role with **Managed Device\n   Cleanup Rules/Update** and **Managed Device Cleanup Settings/Update**.\n2. Enter a name, choose **All platforms** (or a platform), and select **Next**.\n3. Set **Remove devices that haven't checked in for this many days** to\n   `{{ device_cleanup_days }}`. Use **Preview affected devices** to check the list, then create\n   the rule.\n4. Handle Microsoft Entra device objects separately: in **Entra ID** > **Devices** > **All\n   devices**, filter on **Activity** older than the same period, disable the devices, and delete\n   them after a grace period (keep BitLocker and LAPS secrets you still need).\n",
      "rollback": "Delete the cleanup rule. Hidden devices reappear when they check in again.\n"
    },
    "references": [
      {
        "title": "Automatically hide devices with cleanup rules",
        "url": "https://learn.microsoft.com/intune/governance/configure-cleanup-rules",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Maester test MT.1053",
        "url": "https://maester.dev/docs/tests/MT.1053",
        "publisher": "Maester",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-8",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-8(1)",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-DEVICE-001",
        "type": "related"
      },
      {
        "id": "CB-M365-DEVICE-004",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}