Automatic Intune Device Cleanup Rules Delete Stale Devices

Automatic Intune Device Cleanup Rules Delete Stale Devices

by

Key Takeaways:

  • Device Cleanup Rules help remove stale or inactive device records
  • Admins can preview affected devices before deletion
  • Microsoft Intune introduced platform-level device cleanup rules with scoped RBAC permissions
  • Admins to apply different cleanup thresholds per platform

Have you ever faced issues with Intune reporting or compliance reports because of stale device records? If so, I can show you how to set up Automatic Intune Device Cleanup Rules and Delete Stale Devices to prevent these issues from happening. This process is crucial for keeping your Intune environment running smoothly and up-to-date. With automatic cleanup rules in place, you won’t have to worry about manually deleting stale device records, which can be time-consuming and error-prone.

Table of Contents

Video – Automatic Intune Device Cleanup Rules Delete Stale Devices

In this video, let’s discuss Intune Device Clean-up Rules in Detail, Remove Stale Records from Intune and Azure AD, and automate maintenance tasks for Intune.

Automatic Intune Device Cleanup Rules Delete Stale Devices – Video.1

Automatic Intune Device Cleanup Rules Delete Stale Devices

The Intune device clean-up rule to delete stale records allows Intune admins to choose between 30 and 270 days to remove inactive device records from Intune automatically. I recommend keeping these numbers as per your organization’s requirements.

Microsoft Intune introduced platform-level device cleanup rules with scoped RBAC permissions, allowing admins to apply different cleanup thresholds per platform (Windows, iOS, macOS, Android, Linux) and control who can configure or enforce them. This is a major shift from the earlier “all devices” rule, giving more flexibility and governance.

Patch My PC

However, you don’t have the same (like SCCM) control on Intune maintenance tasks. It’s not mandatory to set the cleanup rules within your Intune tenant because of the default behavior explained below.

Intune Maintenance Activities

There are different types of maintenance activities in Intune. The infra side of maintenance activities is not visible to customers. Automatic Intune Device Cleanup Rules is an Intune Maintenance Activity to clean up stale device records from the Intune device management solution.

  • Manual maintenance activities include cleaning old/legacy apps, policies, Wi-Fi, VPN profiles, etc.
Automatic Intune Device Cleanup Rules Delete Stale Devices - Fig.1
Automatic Intune Device Cleanup Rules Delete Stale Devices – Fig.1

How to Delete Device Cleanup Rules

These Device Cleanup rules are available to automatically remove devices that haven’t checked in for several days you set. Go to the Intune pane, choose Devices, and select Device cleanup rules to see a new law.

Note: – This is the Just an example of deleting device cleanup rules.

Automatic Intune Device Cleanup Rules Delete Stale Devices - Fig.2
Automatic Intune Device Cleanup Rules Delete Stale Devices – Fig.2

When setting this Intune Device Cleanup Rule to Yes, Intune deletes devices based on the custom number of days you specify. Choose your device clean rule and click on the 3 dot button and click on the delete button.

Automatic Intune Device Cleanup Rules Delete Stale Devices - Fig.3
Automatic Intune Device Cleanup Rules Delete Stale Devices – Fig.3

After clicking on the delete button, you will get a new window that shows a message as Are you sure want to delete Windowes Clean-up rule? Then click on the Delete button.

Automatic Intune Device Cleanup Rules Delete Stale Devices - Fig.4
Automatic Intune Device Cleanup Rules Delete Stale Devices – Fig.4

NOTE 1 – You can have custom days value between 90 to 270. Set your Intune device cleanup rules to delete Intune MDM enrolled devices that appear inactive, stale, or unresponsive. Intune applies cleanup rules immediately and continuously so that your device records remain current.

NOTE 2—Once you click the Save button, all devices that have been inactive for the specified number of days will immediately be deleted from Intune. Intune will continue to delete devices as they exceed the set number of days. Reports with data about the removed devices may take up to 48 hours to refresh.

When you set Delete Devices based on the last check-in Date to No, Intune automatically deletes all devices that haven’t checked in to Intune for more than 270 days.

After you click Save, all devices that have been inactive for the specified number of days will immediately be deleted from Intune. Intune will continue to delete devices as they exceed the number of set days. Reports with data about the deleted devices may take up to 48 hours to refresh.

Intune Device Cleanup Rules Behavior

Set your Intune device cleanup rules to delete Intune MDM Enrolled and Co-Managed SCCM devices that appear as any of the following conditions, then Intune applies cleanup rules immediately.

Conditions
Inactive
Stale
Unresponsive
Automatic Intune Device Cleanup Rules Delete Stale Devices – Table.1

Intune will also ensure the device’s relevance by continuously performing this cleanup task so that your device records remain current.

NOTE: This deletion action won’t remove or delete or clean up the device from Azure Active Directory. More details are in the Resources section.

How to Find Out Affected Devices

Intune provides an option to identify and export the affected devices using the Device Cleanup rules you just implemented above.

Once you click the Save button on Device Cleanup Rules, all devices that have been inactive for the specified number of days (90 Days in the above example) will immediately be deleted from Intune.

NOTE: To ensure that you are deleting the correct devices, I recommend clicking on the “View Affected Devices” link and confirming whether you want to remove those devices.

These are the devices that haven’t checked in for 180 Days.

Automatic Intune Device Cleanup Rules Delete Stale Devices - Fig.5
Automatic Intune Device Cleanup Rules Delete Stale Devices – Fig.5

How to Configure Cleanup Rules

You can easily Configure Cleanup Rules through Intune Admin Center. Sign with your credentials and go to Devices > Organise Devices > Device Clean-up rules > +Create.

Automatic Intune Device Cleanup Rules Delete Stale Devices - Fig.6
Automatic Intune Device Cleanup Rules Delete Stale Devices – Fig.6

On the basics tab, add the Name and Description as your preferences. The Name is mandatory and description is optional. Click on the Next button.

Automatic Intune Device Cleanup Rules Delete Stale Devices - Fig.7
Automatic Intune Device Cleanup Rules Delete Stale Devices – Fig.7

Rule Settings

You can add the days to Remove devices that haven’t checked in for this many days. The available date range is (30-270). Here I choose 180. Click on the Next button.

Automatic Intune Device Cleanup Rules Delete Stale Devices - Fig.8
Automatic Intune Device Cleanup Rules Delete Stale Devices – Fig.8

Review + Save

On the Review + Save tab you can all the details which are entered in the previous tabs. After reviewing all the details, click on the Save button.

Automatic Intune Device Cleanup Rules Delete Stale Devices - Fig.9
Automatic Intune Device Cleanup Rules Delete Stale Devices – Fig.9

Intune Device Certificate Validity Dependency

Dependencies on Reappearance of devices into Intune console. Microsoft Intune MDM Device CA certificate is valid for 1 year.

The threshold for devices to show up in the Intune portal is 180 days, provided the Intune device certificate has not expired. If you have configured it, Delete devices that haven’t checked in for this many days as 90 days.

Automatic Intune Device Cleanup Rules Delete Stale Devices - Fig.10
Automatic Intune Device Cleanup Rules Delete Stale Devices – Fig.10

Resources

Need Further Assistance or Have Technical Questions?

Join the LinkedIn Page and Telegram group to get the latest step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, join the WhatsApp Community  and the WhatsApp channel to get the latest news on Microsoft Technologies. We are there on Reddit as well.

Author

Anoop C Nair has been Microsoft MVP from 2015 onwards for 10 consecutive years! He is a Workplace Solution Architect with more than 22+ years of experience in Workplace technologies. He is also a Blogger, Speaker, and Local User Group Community leader. His primary focus is on Device Management technologies like SCCM and Intune. He writes about technologies like Intune, SCCM,  Windows,  Cloud PC, Windows, Entra, Microsoft Security, Career, etc.

9 thoughts on “Automatic Intune Device Cleanup Rules Delete Stale Devices”

  1. One of the Microsoft articles says if device checks in before 180 days, it can be auto recovered. Is it 180 days or 365 days. As we have MDM certificate valid for 1 year?
    Reference – techcommunity.microsoft.com/t5/device-management-in-microsoft/using-intune-device-cleanup-rules-amp-160/ba-p/377272

    Reply

  2. Hi Anoop,

    Thank you for sharing a Nice blog about remove stale devices from Intune. Can you please share me the blog which you have created for Autopilot troubleshooting & Monitoring.

    Thanks
    Narayanan

    Reply

  3. Hi Anoop, Thanks for sharing your deep and impressive knowledge of Intune and Cloud management. Like many of us techies who use your articles I haven’t posted my thanks (until now). I do wonder about when the devices that get cleaned up (deleted) from Intune will be removed from the Azure AD database also…? Would this happen automatically after the year long certificate validity expires, or do we need to remove these devices with a script somehow?
    I also wonder about Autopilot device objects (by serial number) in Intune – are these device objects also removed at the same time as the computer hostname Intune object is cleaned by this rule?
    Thanks for your assistance understanding how this works,
    Andy

    Reply

  5. Hi Anoop, I am looking to clarify something I can’t find out for sure. If you pre-provision a windows device via Autopilot, and the device never reaches a user before the clean up rule kicks in, will that device be removed as well?

    We build stock way in advance on occasion so wondering how aggressive we should be with the clean ups.

    Thanks

    Reply

  6. I am curious what is the user experience like for a device returns from being inactive?

    Does the device automatically re-appear in Intune, or would it need to go through re-enrollment with Intune either via ADE/Autopilot/Automatic or manual onboarding?

    From an educational standpoint we may devices that are offline for a few months then suddenly pop up online again, would be very curious to better understand how that all works from a administrator and user perspective side of things.

    Also would the experience be different for a Hybrid vs AAD Environment?

    Reply

  7. Bonjour,
    J’aimerais savoir s’il y’a une possibilité de faire une exception sur certains appareils dont on souhaite encore garder pour des raisons de sensibilités des données.

    Si oui, avez vous une méthode ?

    Reply

Leave a Comment