Why do sporadic devices drop out of Entra?

Question

We have the following setup:

#1: We use Entra ID completely (Not hybrid)

#2: We have autopilot set up, so that when a Windows device joins Entra ID it is enrolled into Intune.

#3: We have turned off the Intune rule that disabled stale devices in Intune.

#4: We do not have any rules in Entra ID that remove stale devices.

Sporadically we will have an issue where a device seems to be removed from Entra ID, and subsequently from Intune as well. We have noticed it during the following scenarios:

#1: Old user will leave the company, and the user locks their computer. When the new user goes to log into the computer, they will reboot the machine to get the "OTHER" user log in, and when they go to log in, we discover the device is missing from Intune and Entra. Is there an audit log feature in Entra that we can turn on to see the history of a missing device. (By the time we realize the issue the device is gone from Entra and Intune, so we currently do not see a way to see logs for a removed device)

Answer 1

@Autumn Fox , Thanks for posting in Q&A. For the device delete issue, I would like to confirm if the issue is only with one device or all the devices are affected.

Meanwhile, could you confirm if the device is unenrolled from device side like remove the device in company portal or disconnect under Settings> Accounts> Access work or school account when the old user is leaving.

Meanwhile, if the device is deleted in Intune portal, you can check the audit log to see if it is recorded.

https://learn.microsoft.com/en-us/mem/intune/fundamentals/monitor-audit-logs

If there's any update, feel free to let us know.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hello @Autumn Fox,Thank you for posting your query on Microsoft Q&A.

Based on your description, it appears that the device is becoming unregistered from Entra and Intune upon restarting. To better understand this scenario, I would like to gather more details about the device. You mentioned it's a "sporadic device"; could you please clarify its intended use? and Device OS?

To investigate the cause, note the timestamp when you reboot the device and review the Entra Audit logs. Filter the logs for Category: Device and Activity: Unregister device, then look for entries matching the reboot timestamp. This will provide details about who initiated the device unregistration under "Initiated by" (actor).

If you require further assistance, please feel free to email me at AzCommunity@microsoft.com, referencing this issue with the subject line "ATTN: pothurajur" and include a link to the current thread.

I hope this information is helpful. Please feel free to reach out if you have any further question.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Thanks,
Raja Pothuraju.