Opselith
POWERSHELL / MICROSOFT.GRAPH.DEVICEMANAGEMENT
ProIntermediateRead-onlylow

Find stale Intune devices

Find Microsoft Intune managed devices whose LastSyncDateTime is blank or older than the threshold you choose.

Open in PowerShell Builder →Browse all scripts

Generated securely after server-side Pro license validation · Review before running · Opselith does not connect to your tenant

What this PowerShell script does

Finds managed devices that have not synced recently.

Requirements

  • Stale days - e.g. 30
  • CSV output path - Example: C:\Temp\report.csv

Environment

  • Module: Microsoft.Graph.DeviceManagement
  • Permissions: DeviceManagementManagedDevices.Read.All
  • Output: CSV report
  • Context: PowerShell 7 · Microsoft Graph
  • Risk: Low
Review before you run The script is generated securely after server-side Pro license validation. Test outside production first.
NEXT STEP

Ready to generate

Configure Find stale Intune devices in the Builder, review the generated PowerShell and run it yourself in your own PowerShell session.

Configure this script →Open Builder
More about this script

Why use this template?

Use this PowerShell template when you need to find managed devices that have not synced recently. It can be previewed in the Builder; Pro access is required to generate it for your own environment.

The template uses Microsoft.Graph.DeviceManagement and requires DeviceManagementManagedDevices.Read.All. Output: CSV report. Level: Intermediate. Action: Read-only. Risk: Low.

Review before running

The script remains preview-only until Pro access is enabled. Review it before running it, and test it outside production first. “Read-only” describes the script itself; anything you add around it can still change data.

Preview the script

  1. Open the template in the PowerShell Builder.
  2. Review the purpose, requirements, permissions, output and risk.
  3. Activate Pro when you are ready to generate the full script, then test it outside production.

Pro templates remain previewable before purchase or activation. No tenant connection is required. When you generate a Pro script, only the configuration values needed for that template are sent to Opselith after license validation.Preview Find stale Intune devices →

How to use this result

Use this report to identify Intune managed-device records that have not reported a recent sync according to the selected threshold.

When this helps

  • Prepare a stale-device review before cleanup, migration or license/device-management work.
  • Find devices with old or missing Intune sync data for owner verification.

How to read the result

  • The script treats a blank LastSyncDateTime or a value older than your cutoff as stale for this report.
  • Intune last sync is different from Entra ApproximateLastSignInDateTime and from proof that a physical device is unused.

Things to check

  • A blank sync value needs investigation rather than automatic deletion.
  • Retired, replaced, re-enrolled or otherwise duplicated device records can require context from Entra, Autopilot and the device owner.

What to do next: Confirm the device owner, enrollment state and related Entra/Autopilot records before retiring or deleting anything.

Related tasks

Official references

Before you runModule, permissions, inputs, compatibility and script checks
OPS / SCRIPT DETAILS

Script details

Finds managed devices that have not synced recently. Review these details before generating or running the script.

intunefinddeviceentrainactive
Generated here. Run by you.Opselith does not connect to your tenant or run PowerShell. After generating, review the script and run it in your own PowerShell session.

What it works with

Module: Microsoft.Graph.DeviceManagement

Microsoft Graph PowerShell lets the script work with Microsoft Entra and Microsoft 365 data through Microsoft Graph.

Context: PowerShell 7 · Microsoft Graph

Compatibility: PowerShell 7 is the supported target for this Microsoft 365 template.

Permissions and changes

Permissions: DeviceManagementManagedDevices.Read.All

Risk: Low

Read-only: designed to collect information without intentionally changing the target environment.

Changes: Read-only. The script reads data and does not intentionally change the target environment.

Inputs

  • Stale days - e.g. 30 (Required)
  • CSV output path - Example: C:\Temp\report.csv (Required)

What to expect

Output: CSV report

Expect a CSV file at the path you choose. Open it in Excel or another CSV viewer and review the rows.

Example: C:\Temp\report.csv

This template is in the Pro library. Generating the full script requires eligible Pro or tester access. Opselith receives only the values needed to build the script; it does not connect to your tenant, run PowerShell or store the generated script. You review and run the result in your own PowerShell session.

Example use

Finds managed devices that have not synced recently.

Enter the required values in the Builder, review the generated script and confirm the output before running it.

Before you run: Make sure your account has DeviceManagementManagedDevices.Read.All. Check that the Microsoft.Graph.DeviceManagement PowerShell module is available and that you are using the supported PowerShell version. Review the generated script and output path, then test outside production first.
Script checksWhat has been verifiedQA reviewed
Static checksPassed
PSScriptAnalyzerPending
Real-world run testNot yet recorded
Last checkedNot yet recorded

Real-world run results are shown only after Opselith reviews and accepts a tester report.

Tester: report a result →
TEST STATUSWhat Opselith has checked

Last reviewed: 10 Sept 2026

PSScriptAnalyzer: Awaiting a release PSScriptAnalyzer gate that includes this script. No analyzer pass is claimed yet.

Pending or Not yet recorded means there is no accepted result on file yet. A passed analyzer check does not mean the script has been run in a real tenant.

PRACTICAL GUIDE

How to use this result

Use this report to find managed devices whose Intune LastSyncDateTime is blank or older than your chosen review threshold.

When this helps

  • Prepare a stale-device cleanup review.
  • Find devices that may no longer be checking in before license, ownership or inventory cleanup.
  • Compare stale-device candidates with compliance state and operating system.

How to read the result

  • The cutoff is calculated in UTC from the number of stale days you enter.
  • A device is included when LastSyncDateTime is missing or older than the cutoff; the output also shows user, compliance state and operating system.

Things to check

  • Old sync time is not proof that a device should be deleted; devices can be offline, retired intentionally or temporarily unused.
  • Review ownership and enrollment history before removing a managed-device record.
What to do next: Sort by LastSyncDateTime, validate the assigned user and device purpose, and only then follow your approved retirement or cleanup process.
NEXT IN THE LIBRARY

Scripts for similar admin tasks and Microsoft services.

Browse Microsoft Intune PowerShell scripts →
POWERSHELLFind duplicate Intune device namesintune · find · devicePOWERSHELLFind duplicate Intune serial numbersintune · find · devicePOWERSHELLFind Intune corporate devicesintune · find · device