Hi,
Indeed, the question is not obvious.
A Device Cleanup rule removes the device from Intune but does not remove it from Azure AD. However, this does not remove it from the subscription as requested in the question. He talks about stale devices, which can represent vulnerabilities, which is why configuring a device cleanup rule is not enough.
https://learn.microsoft.com/en-us/entra/identity/devices/manage-stale-devices
Sincerely,