Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community
Tips on PowerShell Modules for Managing Stale Devices
Published Sep 12 2019 12:00 AM 7,418 Views
Microsoft

Hi All, Alan here PFE from Italy, trying to give some little tips on how to install the correct PS module in order to use the required cmdlets for Stale Device Management.

 

The article explaining this is: How To: Manage stale devices in Azure AD: https://docs.microsoft.com/en-us/azure/active-directory/devices/manage-stale-devices

 

One day you might wonder why you have all those stale devices in your AzureAD. Well maybe the user changed his/her phone and that old object never got removed from AzureAD. Well yes it is a manual process.

 

A good article explaining the difference between Registered and Joined: Azure AD Join vs Azure AD Device Registration: https://blogs.technet.microsoft.com/trejo/2016/04/09/azure-ad-join-vs-azure-ad-device-registration/

 

To get a list of registered devices you have two options, Azure or Office portals:

  • From Azure portal just click on Azure Active Directory and then navigate to Devices / All Devices
  • From Office portal go to Admin page, scroll down to Admin Centers and click on Azure Active Directory. Click on Devices / All Devices

Information is displayed in various columns, in our case we need Join Type, MDM and Activity.

 

Join Type can be:

  • Azure AD Registered à Single Sign On (SSO) and seamless multi-factor authentication across company cloud applications using personal devices in bring your own device (BYOD) scenarios
  • Azure AD Joined à corporate owned device management for users that primarily use cloud applications
  • Empty à could be a device that configured Outlook Mobile or Authenticator and this created a device registration without Intune enrollment

 

MDM can be:

  • Microsoft Intune à enrolled with Intune
  • None à could be a device that configured Outlook Mobile or Authenticator and this created a device registration without Intune enrollment

 

Activity:

  • This is our great friend. Activity timestamp or ApproximateLastLogonTimestamp (from PS)

Enabled :                        True

DeviceTrustType :          Workplace Joined

DeviceTrustLevel :          Compliant

ApproximateLastLogonTimestamp : 23-Apr-19 06:34:22

 

Recalling the first article we read: “Because a stale device is defined as registered device that hasn't been used to access any cloud apps for a specific timeframe, detecting stale devices requires a timestamp-related property. In Azure AD, this property is called ApproximateLastLogonTimestamp or activity timestamp. If the delta between now and the value of the activity timestamp exceeds the timeframe you have defined for active devices, a device is considered to be stale. This activity timestamp is now in public preview.”

 

So I tried to list all stale devices using the cmdlets listed in the article.

Our firsts command would be:

Get-MsolDevice -all | select-object -Property Enabled, DeviceId, DisplayName, DeviceTrustType, ApproximateLastLogonTimestamp | export-csv x:\AllDeviceSlist-Summary.csv

 

This works great but I had Intune policy set to 90 days so I needed to get all stale devices where the Activity was more than 90 days.

 

$date = get-date -date $(get-date).adddays(-90) -format MM-dd-yyyy

Get-MsolDevice -all -LogonTimeBefore $dt | select-object -Property Enabled, DeviceId, DisplayName, DeviceTrustType, ApproximateLastLogonTimestamp | export-csv c:\DeviceList-olderthan-90days-summary.csv

 

-LogonTimeBefore à this one didn’t work for me even with AzureAD PS module and MSOnline module

 

You need latest module for MSonline version 1.1.183.17

In some cases you could have some trouble installing the latest versions, maybe because of proxy, GPOs, some other strange issue

 

I tried to install latest MSOnline and MSOnlineextened modules but that LogonTimeBefore wasn’t there

I removed and reinstalled AzureAD Powershell module and WIF 5.1 then I tried to reinstall

 

Install-module MSOnline

Install-module MSOnlineextended

 

No luck! LogonTimeBefore wasn’t there

 

I solved by manually downloading, unzipping and importing the modules (.psd1 file)

https://www.powershellgallery.com/packages/AzureAD/2.0.2.26

https://www.powershellgallery.com/packages/MSOnline/1.1.183.17

 

And our cmdlet works great

             

$date = get-date -date $(get-date).adddays(-90) -format MM-dd-yyyy

Get-MsolDevice -all -LogonTimeBefore $dt | select-object -Property Enabled, DeviceId, DisplayName, DeviceTrustType, ApproximateLastLogonTimestamp | export-csv c:\DeviceList-olderthan-90days-summary.csv

 

To remove the stale devices you should use the following, careful that this removes all the Stale Devices found at once

 

Get-MsolDevice -all -LogonTimeBefore $dt | remove-msoldevice -force

 

-force à user is not prompted for confirmation

 

Good idea is to filter on DeviceID or ObjectID and try one by one at first

 

 

Hope this helps you a little on device management

 

Alan@PFE

3 Comments
Brass Contributor

Why oh why is this still a manual process?  This just doesn't make sense.  Why can't there be an automated solution (or at least one that doesn't require running code) for clearing out stale devices?  Users are able to rejoin a device to AAD if they need to if it got cleared out of AAD due to being stale.  So again, I don't understand the reasoning...

Brass Contributor

Also you're making this too complicated by using the legacy MSOL powershell module.  If you just use the "new" AAD PowerShell module that has been around for a few years now, you have what you need there.  No need for any random scripts/modules in the TechNet gallery.

 

Get-AzureADDevice | Select DisplayName,DeviceId,ApproximateLastLogonTimeStamp

Steel Contributor

Agree, this should not require manual scripting. It should be a tick box in Azure AD [v] Delete Stale objects after number of days: and you should be able to select nunber of days. It’s already available in Intune for enrolled devices.

 

However, I do appreciate the time spent to write this post :)

 

Maybe there’s a user voice for this already?

Version history
Last update:
‎Feb 20 2020 11:55 AM
Updated by: