Identity & Endpoint Security

Entra ID Stale Device Inactivity Pruner & BitLocker Escrow Validator Agent | LoveSharePoint

By LoveSharePoint Team • Enterprise Architecture Series • Production Verified

1. Executive Summary & Problem Analysis

Stale device registrations in Microsoft Entra ID consume license seats, clutter conditional access telemetry, and leave orphaned BitLocker recovery keys in unmonitored states. When devices are decommissioned without formal offboarding, lingering registrations present a significant security vulnerability.

An autonomous security agent that identifies Entra ID devices inactive for >90 days, confirms BitLocker recovery key escrow status in Microsoft Intune, disables unmonitored registrations, and exports audit-ready compliance reports.

2. Architecture & System Design Principles

When engineering automated enterprise cloud governance solutions, administrators must adhere to the following key design pillars:

Architecture Pillar	Core Requirement	Implementation Guidance
Least-Privilege Security	Entra ID App Registrations with granular scopes	Prefer X.509 Certificate or Azure Managed Identity authentication over static client secrets.
Throttling Resilience	Automated HTTP 429 exponential backoff handling	Implement client-side retry logic and request batching when interacting with Microsoft Graph.
Continuous Auditing	Scheduled automated reporting via CI/CD or Azure	Export structured CSV / JSON telemetry to Azure Blob Storage or SharePoint document hubs.
AI Readiness	Purview sensitivity labels & storage reclamation	Trim excess document version history and enforce labels before enabling M365 Copilot indexing.

3. Production Implementation Script

Below is the complete, production-tested automation script developed by LoveSharePoint Team. Run this module in PowerShell 7+ or your designated cloud automation environment:

# Production Entra ID Stale Device & BitLocker Validator # Author: LoveSharePoint Team [CmdletBinding()] Param( [Parameter(Mandatory=$false)][int]$InactivityDays = 90, [Parameter(Mandatory=$false)][switch]$WhatIf = $true ) Import-Module Microsoft.Graph.Identity.DirectoryManagement -ErrorAction Stop Import-Module Microsoft.Graph.DeviceManagement -ErrorAction Stop Write-Host "=== Connecting to Microsoft Graph API ===" -ForegroundColor Cyan Connect-MgGraph -Scopes "Device.ReadWrite.All", "BitLockerKey.Read.All" $CutoffDate = (Get-Date).AddDays(-$InactivityDays).ToUniversalTime() Write-Host "Scanning for devices inactive since $CutoffDate..." -ForegroundColor Yellow $Devices = Get-MgDevice -All | Where-Object { $_.ApproximateLastSignInDateTime -lt $CutoffDate } $DeviceAudit = [System.Collections.Generic.List[PSObject]]::new() foreach ($Dev in $Devices) { # Check BitLocker Recovery Key Escrow $Keys = Get-MgInformationProtectionBitlockerRecoveryKey -Filter "deviceId eq '$($Dev.DeviceId)'" $HasEscrowedKey = ($Keys.Count -gt 0) $DeviceAudit.Add([PSCustomObject]@{ DeviceId = $Dev.DeviceId DisplayName = $Dev.DisplayName OperatingSystem = $Dev.OperatingSystem ApproximateLastSignIn = $Dev.ApproximateLastSignInDateTime AccountEnabled = $Dev.AccountEnabled HasBitLockerEscrow = $HasEscrowedKey ActionTaken = if ($WhatIf) { "WhatIf: Disable" } else { "Disabled" } }) if (-not $WhatIf) { Write-Warning "Disabling Stale Device: $($Dev.DisplayName) ($($Dev.DeviceId))" Update-MgDevice -DeviceId $Dev.Id -AccountEnabled:$false } } $OutFile = "./Entra_Stale_Devices_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" $DeviceAudit | Export-Csv -Path $OutFile -NoTypeInformation -Encoding UTF8 Write-Host "Scan completed! Found $($Devices.Count) stale devices. Saved to $OutFile" -ForegroundColor Green

💡 Production Tip: Always test automation scripts in an isolated non-production staging or developer sandbox tenant before executing tenant-wide operations in production.

4. Step-by-Step Deployment & Configuration Walkthrough

Step 1: Environment & Module Verification

Verify that your execution runtime has the required PowerShell modules installed with latest security updates:

Ensure PnP.PowerShell (v2.x or later) or Microsoft.Graph is installed in your PowerShell 7 environment.
Verify Microsoft Graph REST API endpoints are reachable without corporate proxy blocks.

Step 2: Authentication & Entra ID Permissions

Navigate to Entra ID -> App registrations -> New registration.
Assign only the minimal required application permissions.
Grant Tenant Admin Consent for the configured API scopes.

Step 3: Scheduling & Unattended Execution

For fully unattended, lights-out operation:

Host the script in an Azure Automation Account or GitHub Actions workflow.
Store sensitive certificate credentials in Azure Key Vault.
Configure automated email alerts upon task failure or security anomaly detection.

5. Frequently Asked Questions (FAQ)

Q: Why should stale devices be disabled before being deleted?

Disabling a device prevents user sign-in and token issuance while preserving BitLocker recovery keys and device telemetry. Permanently deleting a device destroys its BitLocker escrow record, risking permanent data loss if the physical drive needs recovery.

Q: How does Microsoft Entra ID calculate ApproximateLastSignInDateTime?

Entra ID updates this attribute approximately every 14 days during active device token refreshes to avoid high-volume database write locks. A device inactive for >90 days is guaranteed to be obsolete.

Q: Does disabling an Entra device unenroll it from Microsoft Intune?

No. Disabling the Entra ID object revokes token issuance and Conditional Access compliance, but formal unenrollment/wipe must be triggered via Microsoft Intune admin center.

LoveSharePoint - SharePoint & Enterprise AI

Editorial

Monday, October 12, 2026