Intune Device Lifecycle Management: Cleanup Rules, Retirement, and Wipe Policies

Every Intune tenant accumulates device clutter over time — old laptops replaced but never removed from management, personal devices that were briefly enrolled and then forgotten, company devices assigned to staff who have since left. This clutter creates false compliance reports and can create security gaps if old devices still have access to company data.

Automated device cleanup rules

Intune includes device cleanup rules that automatically remove devices that haven't checked in for a specified period. Optimyze configures cleanup rules for every managed client:

• Devices not checked in for 90 days are flagged for review
• Devices not checked in for 180 days are automatically removed from management
• Devices belonging to departed employees are removed within 24 hours of their user account being disabled

Device retirement vs wipe

When removing a device from management, there are two options:

• Retire — removes company data (email, apps, certificates) but leaves personal data intact. Appropriate for BYOD or employee-owned devices.
• Wipe — factory resets the device, removing all data. Appropriate for company-owned devices being reallocated or decommissioned.

The offboarding checklist

When a staff member leaves a client business, Optimyze's offboarding checklist includes: disable the user account in Entra ID, revoke all active sessions, remove the user from all Teams and SharePoint groups, retire or wipe their enrolled devices, remove their email forwarding, and archive their mailbox. This checklist runs within 4 hours of notification from the client. Every step is documented and provided to the client as a record.