Intune Orphaned Devices — Investigation & Remediation Runbook

Primary story: INTUNE-015 — KYLE-LAPTOP orphaned device investigation Scope: Any Intune-managed device with no assigned primary user, no recent check-in, or an owner who is no longer on staff. Owner: Rory (approver) / Kobe (investigation + remediation automation) Related: Intune Non-Compliance Investigation, Common Tasks

What "orphaned" means here

An Intune device is considered orphaned when one or more of the following is true:

1. No primary user — the device has no userPrincipalName or userId assigned.
2. Stale user — the assigned user is disabled or deleted in Entra.
3. Extended sync gap — lastSyncDateTime is more than 30 days in the past and the device is not known to be archived.
4. Unknown provenance — the device exists in Intune but is not present in our asset inventory.

KYLE-LAPTOP triggered this runbook via condition (1): it appears in /deviceManagement/managedDevices with userPrincipalName: null and userId: null, last sync February 2026.

Standing rule

Rory must confirm in writing before any orphaned device is retired or wiped. The retire/wipe actions are destructive and audit-visible. Assignment and quarantine operations can be done by Kobe under existing delegated permissions.

Investigation — KYLE-LAPTOP (2026-04-16)

Step 1: Pull the Intune device record

Use the Intune admin center or Graph:

GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?$filter=deviceName eq 'KYLE-LAPTOP'

Capture: id, deviceName, serialNumber, userPrincipalName, userId, lastSyncDateTime, enrolledDateTime, operatingSystem, managedDeviceOwnerType, enrollmentType, complianceState.

Step 2: Correlate with Entra

Search Entra for any user whose UPN begins with kyle:

GET https://graph.microsoft.com/v1.0/users?$filter=startswith(userPrincipalName,'kyle')

For each match, record: accountEnabled, signInActivity.lastSignInDateTime, employeeHireDate, department, assignedLicenses.

Step 3: Correlate with the asset inventory

Check the asset inventory spreadsheet / database:

• Is the serial number assigned to a named person?
• Is the device flagged as lost, stolen, returned, or in spare pool?
• Is there a purchase order tied to this serial?

Step 4: Correlate with HR

If no current Entra user matches, ask HR:

• Was there a "Kyle" on staff in the last 24 months?
• If yes: termination date, was equipment returned, was offboarding checklist completed?

Step 5: Check sign-in telemetry

Entra sign-in logs filtered by deviceDetail/displayName eq 'KYLE-LAPTOP' for the last 90 days. Any sign-in attempt (including failed) tells us the device is still being used, which changes the remediation path.

Step 6: Determine category

Based on the above, the device falls into one of four categories:

Category	Evidence	Remediation path
Active + current user	Recent sign-in, user on staff	Re-assign primary user in Intune
Active + former user	Recent sign-in, former staff	Quarantine → investigate possible account takeover
Unused + recoverable	No recent sign-in, device physically accounted for	Reset / reassign to spare pool
Unused + unrecoverable	No recent sign-in, device unaccounted for	Retire + wipe + write off

Remediation paths

Path A: Re-assign primary user

When the device is clearly in active use by a current staff member, just correct the Intune record.

POST https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{id}/users/$ref
Content-Type: application/json

{
  "@odata.id": "https://graph.microsoft.com/v1.0/users/{userId}"
}

Document the reassignment in the device record's notes field and in the asset inventory.

Path B: Quarantine

When sign-in activity continues but no current user owns the device, there is a non-zero chance of an account-takeover or an offboarding miss. Do not retire yet — quarantine first so forensic evidence is preserved.

1. Apply the Device-Quarantine compliance policy (blocks company resource access via Conditional Access).
2. Open an incident per Incident Response.
3. Preserve a Defender for Endpoint live-response snapshot before any remediation action.
4. Escalate to Rory for device seizure decision.

Path C: Reset & reassign to spare pool

When the device is unused but physically accounted for and intended for reuse:

1. Confirm with Rory that the device should be reset rather than retired.
2. In Intune, trigger Fresh Start (preserves enrollment) or Wipe (full factory reset).
3. Update asset inventory to "spare pool, pending reassignment".

Path D: Retire + wipe + write off

When the device is unused and unaccounted for (lost, stolen, or hardware failed and was replaced without decommissioning the Intune record):

1. Rory confirms retirement in writing (Teams message or email, attached to the asset record).
2. In Intune, trigger Retire (removes company data, unenrolls, but leaves user data intact in case the device resurfaces) followed by Delete after 30 days if still no contact.
3. If the device is suspected lost/stolen: Wipe (full factory reset) immediately in addition to Retire.
4. Update asset inventory to "retired, written off, date".
5. If the serial is under warranty or lease, close the asset tracking entry with the vendor.

Decision record template

For each orphaned device investigated, capture (in the ticket or this runbook as an appendix):

Device name:
Serial:
Intune device ID:
Last sync:
Last sign-in:
Evidence of current user (if any):
Category assigned:
Remediation path taken:
Rory confirmation (for paths B, D):
Date completed:

KYLE-LAPTOP — current finding

Investigation pending completion — this runbook is the procedure; the per-device findings will be recorded in the INTUNE-015 ticket and the asset inventory. Initial signal: no primary user, last sync February 2026, no sign-in activity since.

Preliminary category: likely Path D (unused + unrecoverable) pending confirmation that no current staff member named Kyle exists and that the serial is not in the spare pool. Rory confirmation required before retire/wipe.

Preventing future orphans

• Enroll all new devices via Autopilot with a mandatory primary user at provisioning time.
• Offboarding checklist (owned by HR with IT sign-off) must include Intune device reassignment or retirement before an employee's last day.
• Monthly automation: list devices with userPrincipalName eq null and open a ticket for each.
• Annual: cross-check Intune device list against asset inventory (part of the annual review checklist).

References

• Intune Non-Compliance Investigation
• Incident Response
• Common Tasks
• Microsoft docs — Manage devices in Intune: learn.microsoft.com/mem/intune/remote-actions/device-management
• Microsoft docs — Retire vs Wipe: learn.microsoft.com/mem/intune/remote-actions/devices-wipe