(214) Microsoft Azure - Automatically clean up inactive Entra ID devices using Azure Automation

Mr B SOE way

Sep 1

2 min read

Updated: Sep 2

Microsoft Entra ID environments often become filled with old and inactive devices. Cleaning up these devices manually takes time and is easy to forget. By using Azure Automation, we can fully automate this process and remove devices that have been inactive for more than 180 days.

Requirements:

An Azure subscription
PowerShell 7 installed
Microsoft Graph PowerShell module installed

Scripts can be found here GitHub - mrbernardmah/Device-Cleanup-in-Entra-ID · GitHub

Navigate to https://portal.azure.com/ then in the search resources field, enter in Automation Accounts. Click on Automation Accounts.

Under Basics, select your resource group along with an automation account name and region.

Under Advanced, select System assigned. Then select Next.

Under Networking, select Public Access. Then select Next.

Under Review + create, select Create.

Select "Go to resource" once completed.

Then under the 'Automation account', expand Account Settings then select Identity.

Copy and paste the Object (Principal ID) into the script.

Download the setup script from https://github.com/mrbernardmah/Device-Cleanup-in-Entra-ID/blob/main/Setup%20Script.ps1 You will need modify the $ManagedIdentityObjectID based upon what was defined under Object (Principal ID) as mentioned above.

Then run the 'Setup Script.ps1' from where it is: https://github.com/mrbernardmah/Device-Cleanup-in-Entra-ID/blob/main/Setup%20Script.ps1 from your device. If you do not have any of the modules installed, it will prompt you to install it.

You will be prompted to login with your credentials, if this is your first time click Accept.

After logging in successfully, the correct permissions will be assigned to the Managed Identity, and the Automation can now be tested.

In the PowerShell, you will get the permissions applied for the Automation account.

Under the Automation account, expand Shared Resources then select Modules then select Browse Gallery.

You will need to install two modules:

Microsoft.Graph.Authentication
Microsoft.Graph.Identity.DirectoryManagement

From the Browse Gallery, select on Microsoft.Graph.Authentication

Then click on Select.

Make sure to select Runtime version to 7.2 then select Import.

Do the same for Microsoft.Graph.Identity.DirectoryManagement, then click on Select.

Make sure the Runtime version is set to 7.2. Select Import.

Once the modules have been added, you will notice that both of the modules have been installed.

Under Automation Account, expand Process Automation then select Runbooks then select Create a runbook.

Under Basics, enter the desired info for the creating the runbook, in this instance I am using:

Name: Clean-Stale-Devicies-In-Entra

Runbook type: PowerShell

Runtime version: 7.2

Description: Entra ID Stale Device Cleanup

Then select Next.

Under Review + Create, select Create

Copy and paste the .ps1 (https://github.com/mrbernardmah/Device-Cleanup-in-Entra-ID/blob/main/Cleanup%20Entra%20ID%20Stale%20Devices.ps1) into "Edit PowerShell Runbook", then click Save

Change the $InactiveDays and $Action to what you want.

Then select Publish, then select Yes when prompted.

Then click on the recent added Runbook. Then click Start then click "Yes" to start runbook.

If you select Output, you will see what has been deleted.

Under the Automation account, expand Shared Resources then Schedules

Select Add a schedule, then enter a name for the new schedule then choose the dates and timezone on when the automation should should run then select Create.