Soft delete for Entra device objects: a safety net for device clean-ups

Every tenant collects stale device objects: machines rebuilt, replaced or lost years ago. Cleaning them up is good hygiene, but deleting the wrong device is painful. Its identity, the BitLocker recovery keys stored against it and other security data go with it.

A new preview adds soft delete for device objects. Deleted devices move into a recoverable state and can be restored within a retention period, with their identity and associated security artifacts intact. It covers Entra joined, Entra registered and hybrid joined devices.

A safer stale-device process

1. Find devices with no sign-in activity for a long period, such as 90 days or more, using the approximateLastSignInDateTime property.
2. Disable them first and wait. If nobody complains, move on.
3. Check Intune and your other tools so you're not deleting a device that's still managed.
4. Delete in batches. With soft delete, a mistake can be restored rather than rebuilt.

Connect-MgGraph -Scopes "Device.Read.All"

$cutoff = (Get-Date).AddDays(-90)
Get-MgDevice -All -Property DisplayName,OperatingSystem,ApproximateLastSignInDateTime,AccountEnabled |
  Where-Object { $_.ApproximateLastSignInDateTime -lt $cutoff } |
  Sort-Object ApproximateLastSignInDateTime |
  Select-Object DisplayName, OperatingSystem, ApproximateLastSignInDateTime, AccountEnabled

Before you delete anything

Disable in bulk

Connect-MgGraph -Scopes "Device.ReadWrite.All"
$cutoff = (Get-Date).AddDays(-90)
$stale = Get-MgDevice -All -Property Id,DisplayName,ApproximateLastSignInDateTime,AccountEnabled |
  Where-Object { $_.AccountEnabled -and $_.ApproximateLastSignInDateTime -lt $cutoff }
$stale | Export-Csv stale-devices.csv -NoTypeInformation   # keep a record
$stale | ForEach-Object { Update-MgDevice -DeviceId $_.Id -AccountEnabled:$false }