Intune Device Cleanup Rules Explained

A fleet that’s been running for a few years always has the same problem: the device list in Intune stops matching reality. Laptops get replaced, employees leave, test devices never get decommissioned properly — and nobody notices until a report is wrong or a license count looks off. Intune’s device cleanup rules are the built-in fix, and they’re genuinely simple to set up. The part worth knowing before you do is what “cleaned up” actually means, and the one fleet type this rule quietly skips entirely.

Key takeaways

Device cleanup rules hide stale device records from the Intune console and reports — they don’t wipe, retire, or touch the physical device, and they don’t remove anything from Microsoft Entra ID. You set a threshold between 30 and 270 days of no check-in, per platform if you want different thresholds for different device types. A hidden device can reappear automatically if it checks in again before its device certificate expires — no re-enrollment needed; after that, re-enrollment is required. And the one gotcha worth knowing up front: cleanup rules aren’t available for Jamf-managed devices — if you’re co-managing a Mac fleet with Jamf Pro, those records won’t be touched by this feature at all.

What actually happens when the rule fires

A cleanup rule runs on a schedule and hides any device that hasn’t checked in within the window you set. “Hidden” is the operative word — the record disappears from the Intune admin center’s device list and from reports, but Intune doesn’t send the device any command, doesn’t wipe it, doesn’t retire it, and doesn’t touch its Microsoft Entra ID device record. If you need the Entra ID side cleaned up too, that’s a separate, deliberate process — see Microsoft’s guidance on managing stale devices in Entra ID, because this rule won’t do it for you.

The mechanics: 30 to 270 days, one rule per platform

You pick a platform — Windows, iOS/iPadOS, macOS, the various Android enrollment types, ChromeOS, and a few others — or apply a rule to all platforms, and set the inactivity threshold anywhere from 30 to 270 days. You can create one rule per platform, which matters if your Windows fleet and your mobile fleet have genuinely different normal-absence patterns. One detail that’ll bite you if you’re not expecting it: if you have both a platform-specific rule and an “all platforms” rule active, whichever one specifies fewer days wins for that platform, not the more specific one by default. Use Preview affected devices before creating any rule — it shows you exactly which devices would be hidden at your chosen threshold, which is the only way to catch a surprisingly large number before it happens instead of after.

The recovery window most people don’t know about

Hiding isn’t necessarily permanent. If a device checks back in before its device certificate expires, it reappears in the console on its own — no re-enrollment, no admin action needed. That’s a meaningful detail for exactly the scenario the “important point” warnings always raise: an employee on extended leave, a seasonal device, a loaner that sat in a drawer for four months. As long as the cert hasn’t expired by the time it reconnects, the record comes back as if nothing happened. Only once the certificate has actually expired does the device need to go through enrollment again — so a conservative threshold plus that recovery window is more forgiving than “hidden” makes it sound.

The gotcha for mixed Jamf and Intune fleets

This is the detail that matters most if you’re running the kind of dual-MDM setup a lot of orgs land on — Jamf Pro for Mac, Intune for Windows and mobile, both reporting into the same Entra ID tenant for Conditional Access. Microsoft’s own documentation states plainly that device cleanup rules aren’t available for Jamf-managed devices. If your Macs are enrolled through Jamf rather than Intune directly, this feature simply doesn’t see them — setting an aggressive cleanup threshold on your Windows fleet does nothing for the stale Mac records piling up on the Jamf side. That inventory still needs its own process: Jamf Pro’s own Smart Groups and inactivity reporting, reviewed on its own schedule, separate from whatever you’ve configured in Intune.

Setting one up without surprises

Permissions: you need the Intune Administrator role, or a custom role with Managed Device Cleanup Rules/Update and Managed Device Cleanup Settings/Update permissions, plus read access to managed devices.
Preview before you create. Run Preview affected devices at your intended threshold first — it’s a free look at exactly what you’re about to hide.
Start conservative. Given devices can reappear automatically up until cert expiry, there’s little downside to starting near the long end of the 30–270 day range and tightening later once you’ve watched a cycle or two.
Track it in audit logs. Every hide action shows up under Activity name > Device set to be hidden from admin by Device Cleanup Rule [your rule name] — worth knowing if someone asks “where did this device go” six months from now.

Bottom line

Device cleanup rules do exactly one narrow thing well: keep the Intune console honest about which devices are actually still out there. They’re not a decommissioning tool, they’re not an Entra ID cleanup tool, and — if any part of your fleet is Jamf-managed — they’re not a complete inventory solution on their own. Know which of those three things you actually need before you assume this one setting covers it.