KBY Technologies Logo
Microsoft Entra ID · PowerShell 7.6

Stale devices in Entra ID

Which devices registered in Microsoft Entra ID have not been used to sign in for 90 days (or the number of days you pass)?

Script

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.Identity.DirectoryManagement
# Entra ID devices with no sign-in activity in the last -Days days. Read-only.
param(
    [int]$Days = 90
)

Connect-MgGraph -Scopes 'Device.Read.All' -NoWelcome

$dt = (Get-Date).AddDays(-$Days)

Get-MgDevice -All -Property 'id', 'deviceId', 'displayName', 'operatingSystem', 'operatingSystemVersion', 'trustType', 'accountEnabled', 'approximateLastSignInDateTime' |
    Where-Object { $_.ApproximateLastSignInDateTime -le $dt } |
    Sort-Object ApproximateLastSignInDateTime |
    Select-Object DisplayName, DeviceId, OperatingSystem, OperatingSystemVersion, TrustType, AccountEnabled, ApproximateLastSignInDateTime

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

  • Uses ApproximateLastSignInDateTime, the timestamp Microsoft's stale-device guidance is built on. Devices that have never signed in are included.
  • This only lists devices. Microsoft's guidance covers what to check (Autopilot, BitLocker keys, Intune) before disabling or deleting any of them.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.

Connect-MgGraph (Microsoft.Graph.Authentication)Get-MgDevice (Microsoft.Graph.Identity.DirectoryManagement)How to manage stale devices in Microsoft Entra IDGet-Date (Microsoft.PowerShell.Utility)Where-Object (Microsoft.PowerShell.Core)Sort-Object (Microsoft.PowerShell.Utility)Select-Object (Microsoft.PowerShell.Utility)
All scripts