Connect to your tenant
Sign in with the account you manage devices with. The tool reads Entra devices and their activity through Microsoft Graph, as you.
Delegated permissions asked at sign-in:
Device.Read.Alllist Entra devices with last sign-inDeviceManagementManagedDevices.Read.AllIntune primary user, last sync and Autopilot state (optional, listing works without it)
Asked only when you first disable, enable or delete: Directory.AccessAsUser.All. Graph has no narrower delegated permission for changing or deleting devices. The token can then do what your role allows, nothing more.
Roles: Cloud Device Administrator can disable, enable and delete. Writing the timestamp to an extension attribute needs Intune Administrator.
Scan settings
Loading only reads. Nothing changes until you select devices, choose an action and confirm it.
Disable timestamp
When disabling, optionally write a timestamp to an extension attribute. The Past grace period tab uses it to find devices that stayed disabled long enough to delete.
Devices
Load the devices on the Scan tab first.
| Device | Primary user | OS | Join type | Autopilot | Managed | Enabled | Created | Last active | Inactive |
|---|
Devices past their grace period
Disabled devices with an InactiveDevices timestamp in the chosen extension attribute that is older than the grace period. Each device is read again from Graph right before it is deleted; anything enabled or changed since is skipped, and so are Autopilot devices.
| Display name | OS | Autopilot | Disabled at | Days disabled | Object id |
|---|
Nothing past the grace period
No disabled devices with an expired InactiveDevices timestamp.
About InactiveDevices
InactiveDevices lists the devices in Entra ID with their last activity so you can find the stale ones and disable, enable or delete them in bulk.
What it does
- Lists every Entra device with OS, join type, Autopilot, managed state, creation date and last activity.
- Adds the Intune primary user and last sync date when Intune data is readable.
- Filters on inactivity, age, OS, join type, Autopilot, managed state, primary user and enabled state.
- Disables, enables or deletes the selection after showing exactly which devices change. Autopilot devices are skipped for disable and delete.
- Optionally stamps disabled devices in an extension attribute, so the Past grace period tab can delete them later.
- Exports the filtered list to Excel or CSV.
How it works
- Devices:
GET /beta/devices?$select=...,physicalIds,extensionAttributes. - Intune:
GET /beta/deviceManagement/managedDevices?$select=azureADDeviceId,userPrincipalName,lastSyncDateTime,autopilotEnrolled,.... - Inactivity: the newest of
approximateLastSignInDateTimeand IntunelastSyncDateTime. Without either it falls back to the creation date. - Autopilot: Intune
autopilotEnrolled, or a[ZTDId]entry inphysicalIdsfor devices Intune does not know. - Disable and enable:
PATCH /v1.0/devices/{id}withaccountEnabledand the optional timestamp. - Delete:
DELETE /v1.0/devices/{id}. Deleted devices cannot be restored.
Permissions
Reading needs Device.Read.All, plus DeviceManagementManagedDevices.Read.All for the Intune data. For changes Microsoft documents Directory.AccessAsUser.All as the only delegated permission for updating and deleting devices (Device.ReadWrite.All exists for app-only access). It is asked the first time you confirm a change.
Recommended workflow
- Pick an extension attribute and a grace period on the Scan tab.
- Load the devices, filter, select and Disable.
- Later, use the Past grace period tab to delete only the devices that stayed disabled long enough.