How to Delete Windows Autopilot Devices from Intune, Entra ID, and M365

Start by removing the device from the Autopilot registry in Intune. This step is crucial because Autopilot registration blocks deletion from Entra ID.

Navigate to the Microsoft Intune admin center at https://endpoint.microsoft.com. Go to Devices → Enroll devices → Windows Autopilot devices.

Use the search bar to find your device by serial number or hardware hash. You can also filter by device name if you know it.

# Alternative: Find device via PowerShell Graph query
Connect-MgGraph -Scopes "DeviceManagementServiceConfig.ReadWrite.All"
Get-MgDeviceManagementWindowsAutopilotDeviceIdentity | Where-Object {$_.SerialNumber -eq "YOUR_SERIAL_NUMBER"}

Select the device from the list and click Delete. Confirm the deletion when prompted.

Next, remove the device from Intune's managed devices list if it appears there. This step retires the device and removes it from the Company Portal.

In the Intune admin center, navigate to Devices → All devices. Search for your device by name, user, or device ID.

Select the device and click Delete. This action will:

• Issue a retire command to the device
• Remove the device from the Company Portal
• Unenroll the device from Intune management
• Remove company data (depending on your policies)

# PowerShell alternative for bulk operations
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.ReadWrite.All"
$devices = Get-MgDeviceManagementManagedDevice | Where-Object {$_.DeviceName -like "*PATTERN*"}
foreach ($device in $devices) {
    Remove-MgDeviceManagementManagedDevice -ManagedDeviceId $device.Id
    Write-Host "Deleted device: $($device.DeviceName)"
}

Now that the Autopilot registration is removed, you can delete the device from Entra ID (formerly Azure AD). This step removes the device identity and revokes access to organizational resources.

Open the Microsoft Entra admin center at https://entra.microsoft.com. Navigate to Devices → All devices.

Search for your device by name, device ID, or other attributes. You can use filters to narrow down the results if you have many devices.

Select the device and optionally click Disable first to immediately block access while keeping the device record. Then click Delete and confirm the action.

# PowerShell method for Entra ID device deletion
Connect-MgGraph -Scopes "Device.ReadWrite.All"

# Find device by name
$device = Get-MgDevice -Filter "displayName eq 'DEVICE_NAME'"

# Or find by device ID
$device = Get-MgDevice -Filter "deviceId eq 'DEVICE_ID'"

# Delete the device
Remove-MgDevice -DeviceId $device.Id
Write-Host "Deleted device: $($device.DisplayName) from Entra ID"

For hybrid Azure AD-joined devices, additional steps are required to prevent the device from reappearing due to Active Directory synchronization.

First, identify if your device is hybrid-joined by checking its join type in Entra ID. Look for "Hybrid Azure AD joined" in the device details.

Connect to your on-premises domain controller and open Active Directory Users and Computers. Navigate to the Computers container or the specific OU where the device is located.

# PowerShell to find and delete from on-premises AD
Import-Module ActiveDirectory

# Find the computer object
$computer = Get-ADComputer -Filter "Name -eq 'DEVICE_NAME'"

# Delete the computer object
Remove-ADComputer -Identity $computer.DistinguishedName -Confirm:$false
Write-Host "Deleted $($computer.Name) from on-premises AD"

Right-click the computer object and select Delete. This prevents Azure AD Connect from re-synchronizing the device.

Wait for the next Azure AD Connect sync cycle (typically 30 minutes) or force a sync:

# Force Azure AD Connect sync (run on sync server)
Start-ADSyncSyncCycle -PolicyType Delta

Sometimes Autopilot devices exist in the backend but don't appear in the Intune console. Use Microsoft Graph Explorer to find and remove these orphaned records.

Open Graph Explorer at https://developer.microsoft.com/graph/graph-explorer and sign in with your admin account.

First, find the device in Entra ID to get its Azure AD device ID. Run this query in Graph Explorer:

GET https://graph.microsoft.com/v1.0/devices?$filter=displayName eq 'DEVICE_NAME'

Copy the deviceId from the response. Then search for the corresponding Autopilot record:

GET https://graph.microsoft.com/v1.0/deviceManagement/windowsAutopilotDeviceIdentities?$filter=azureActiveDirectoryDeviceId eq 'DEVICE_ID'

If an Autopilot record is found, note the id and serialNumber. Delete it using:

DELETE https://graph.microsoft.com/v1.0/deviceManagement/windowsAutopilotDeviceIdentities/AUTOPILOT_ID

Alternatively, use PowerShell for the same operations:

# Find Autopilot device by Azure AD device ID
$autopilotDevice = Get-MgDeviceManagementWindowsAutopilotDeviceIdentity -Filter "azureActiveDirectoryDeviceId eq 'DEVICE_ID'"

# Delete the Autopilot record
Remove-MgDeviceManagementWindowsAutopilotDeviceIdentity -WindowsAutopilotDeviceIdentityId $autopilotDevice.Id

For organizations with many stale devices, use PowerShell scripts to automate the deletion process across all three platforms.

First, install the required PowerShell modules:

# Install Microsoft Graph modules
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
Install-Module Microsoft.Graph.DeviceManagement -Scope CurrentUser
Install-Module Microsoft.Graph.Identity.DirectoryManagement -Scope CurrentUser

Create a text file with device names (one per line) and save it as devices.txt. Then run this comprehensive script:

# Connect with required permissions
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.ReadWrite.All", "DeviceManagementServiceConfig.ReadWrite.All", "Device.ReadWrite.All"

# Read device list
$deviceNames = Get-Content "C:\temp\devices.txt"

foreach ($deviceName in $deviceNames) {
    Write-Host "Processing device: $deviceName" -ForegroundColor Yellow
    
    # Step 1: Find and delete Autopilot record
    $autopilotDevice = Get-MgDeviceManagementWindowsAutopilotDeviceIdentity | Where-Object {$_.DisplayName -eq $deviceName}
    if ($autopilotDevice) {
        Remove-MgDeviceManagementWindowsAutopilotDeviceIdentity -WindowsAutopilotDeviceIdentityId $autopilotDevice.Id
        Write-Host "  Deleted from Autopilot" -ForegroundColor Green
    }
    
    # Step 2: Find and delete from Intune managed devices
    $intuneDevice = Get-MgDeviceManagementManagedDevice | Where-Object {$_.DeviceName -eq $deviceName}
    if ($intuneDevice) {
        Remove-MgDeviceManagementManagedDevice -ManagedDeviceId $intuneDevice.Id
        Write-Host "  Deleted from Intune" -ForegroundColor Green
    }
    
    # Step 3: Find and delete from Entra ID
    $entraDevice = Get-MgDevice -Filter "displayName eq '$deviceName'"
    if ($entraDevice) {
        Remove-MgDevice -DeviceId $entraDevice.Id
        Write-Host "  Deleted from Entra ID" -ForegroundColor Green
    }
    
    Start-Sleep -Seconds 2  # Rate limiting
}

Before completing the device deletion process, handle BitLocker recovery keys and other dependencies that might be orphaned.

BitLocker recovery keys are stored in Entra ID and should be backed up before device deletion. Navigate to the device in Entra ID and check for BitLocker keys in the device details.

# Export BitLocker keys before deletion
Connect-MgGraph -Scopes "BitLockerKey.Read.All", "Device.Read.All"

$device = Get-MgDevice -Filter "displayName eq 'DEVICE_NAME'"
$bitlockerKeys = Get-MgInformationProtectionBitlockerRecoveryKey -Filter "deviceId eq '$($device.DeviceId)'"

foreach ($key in $bitlockerKeys) {
    $keyDetails = Get-MgInformationProtectionBitlockerRecoveryKey -BitlockerRecoveryKeyId $key.Id
    Write-Host "Device: $($device.DisplayName)"
    Write-Host "Key ID: $($key.Id)"
    Write-Host "Recovery Key: $($keyDetails.Key)"
    Write-Host "Created: $($key.CreatedDateTime)"
    Write-Host "---"
}

Check for other dependencies that might need cleanup:

• Compliance policies: Remove device-specific compliance assignments
• Configuration profiles: Clean up device-targeted configurations
• App assignments: Remove device-specific app deployments
• Conditional Access: Update any device-based CA policies

# Check for assigned policies (requires additional Graph scopes)
Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All"

# Get device compliance policies
$compliancePolicies = Get-MgDeviceManagementDeviceCompliancePolicy
foreach ($policy in $compliancePolicies) {
    $assignments = Get-MgDeviceManagementDeviceCompliancePolicyAssignment -DeviceCompliancePolicyId $policy.Id
    # Check if device is specifically targeted
}

Perform a final verification to ensure the device is completely removed from all Microsoft platforms and won't cause future conflicts.

Run these verification commands to confirm complete removal:

# Comprehensive verification script
Connect-MgGraph -Scopes "Device.Read.All", "DeviceManagementManagedDevices.Read.All", "DeviceManagementServiceConfig.Read.All"

$deviceName = "YOUR_DEVICE_NAME"

# Check Entra ID
$entraCheck = Get-MgDevice -Filter "displayName eq '$deviceName'"
if ($entraCheck) {
    Write-Host "WARNING: Device still exists in Entra ID" -ForegroundColor Red
} else {
    Write-Host "✓ Device removed from Entra ID" -ForegroundColor Green
}

# Check Intune managed devices
$intuneCheck = Get-MgDeviceManagementManagedDevice | Where-Object {$_.DeviceName -eq $deviceName}
if ($intuneCheck) {
    Write-Host "WARNING: Device still exists in Intune" -ForegroundColor Red
} else {
    Write-Host "✓ Device removed from Intune" -ForegroundColor Green
}

# Check Autopilot
$autopilotCheck = Get-MgDeviceManagementWindowsAutopilotDeviceIdentity | Where-Object {$_.DisplayName -eq $deviceName}
if ($autopilotCheck) {
    Write-Host "WARNING: Device still exists in Autopilot" -ForegroundColor Red
} else {
    Write-Host "✓ Device removed from Autopilot" -ForegroundColor Green
}

Write-Host "Verification complete for device: $deviceName"

Additionally, check these locations manually:

• Microsoft 365 admin center: Go to Devices → Active devices to ensure the device doesn't appear
• Security & Compliance center: Check device compliance reports
• Endpoint Analytics: Verify the device is removed from startup performance and other reports

For hybrid environments, also verify on-premises:

# Check on-premises AD (run on domain controller)
Import-Module ActiveDirectory
$adCheck = Get-ADComputer -Filter "Name -eq '$deviceName'" -ErrorAction SilentlyContinue
if ($adCheck) {
    Write-Host "WARNING: Device still exists in on-premises AD" -ForegroundColor Red
} else {
    Write-Host "✓ Device removed from on-premises AD" -ForegroundColor Green
}