Is That Entra Device Record Stale, Duplicate, or Still in Use?
Build an owner-reviewed evidence trail before disabling device identities that merely look old in the portal.
Old-looking Entra device records are not automatically safe to disable. Reimaging, naming reuse, hybrid registration, shared ownership, and delayed activity signals can make an active device resemble an abandoned one.
A cautious workflow correlates inventory, compliance, sign-in, and audit evidence before an owner approves action. PSForge generates Entra PowerShell steps; it does not decide that a device is stale or disable identities without an administrator running the reviewed script.
Prerequisites and safe scope
Define an inactivity threshold approved by identity and endpoint owners, a pilot population, excluded device classes, and an evidence retention path. Confirm Graph permissions and use stable device IDs throughout.
- Exclude break-glass, kiosk, shared, and infrastructure devices until owners review them.
- Never rely on display name alone.
- Start with disablement, not deletion, where policy permits.
Build the candidate record
List all devices and export inventory by model, owner, and OS. Add device compliance status, then query sign-in and audit logs for the approved window. Manually reconcile duplicate names, hybrid identities, known rebuilds, ownership, and service-ticket activity.
Approve, disable, and observe
Send candidates to device or application owners and record the review outcome. Keep the PSForge workflow preview-only. If policy allows remediation, an administrator must prepare and independently review an exact device-ID-scoped command outside this workflow; the available age-filter disable task is tenant-wide and is intentionally not cited. Monitor support and sign-in signals through the organization's normal process before any separate deletion decision.
Evidence is incomplete by nature No single report proves a device is abandoned. Ownership confirmation, environment-specific exclusions, and exact-ID scoping remain manual safeguards.
Example stale-device review
- List Entra devices
- Export model, owner, and OS inventory
- Add compliance status
- Review sign-in and audit evidence
- Resolve duplicates and obtain owner review
- Keep generated workflow read-only; handle any exact-ID remediation manually
Final thoughts
Clean device identity data is valuable, but an overly aggressive cleanup creates access incidents.
Correlate signals, involve owners, keep generated steps read-only, and reserve exact-ID remediation for a separately governed decision.