Inactive Devices (90 days)

The question it answers: Which Entra ID devices have not signed in for 90 days, or never?

Note

Inactive means no approximateLastSignInDateTime in the last 90 days (fixed in the page) or none recorded.

At a glance

Where in the app	Entra ID › Devices › Inactive Devices
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	No extra licence needed.
Report id (API and MCP)	entra.devices.inactive

Columns

Column	Key	Type
Display Name	DisplayName	Link
Object Id	ObjectId	Text
Entra Device Id	DeviceId	Text
Is compliant	IsCompliant	YesNo
OS Name	OperatingSystem	Text
OS Version	OperatingSystemVersion	Text
Approximate Last SignIn Date	ApproximateLastSignInDateTime	DateTime
Is Managed	IsManaged	YesNo
OnPremises Sync Enabled	OnPremisesSyncEnabled	YesNo
On Premises Last Sync Timestamp	OnPremisesLastSyncDateTime	DateTime

Filters

Filter	Key (API)	On when the page opens
Show only cloud Devices	cloud	No
Show only incompliant Devices	incompliant	No
Show only unmanaged Devices	unmanaged	No

What it needs

Licence: No extra licence needed.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Device.Read.All	Microsoft Graph	Read all devices
User.Read.All	Microsoft Graph	Read all users’ full profiles

Data sources it reads

• GET /v1.0/devices?$select=...&$expand=registeredOwners($select=id,userPrincipalName)
• GET /v1.0/devices?$select=id,deviceId&$expand=registeredUsers($select=id,userPrincipalName)

Through the API and MCP

GET /ir-api/v1/reports/entra.devices.inactive?size=100
GET /ir-api/v1/reports/entra.devices.inactive?filter=cloud

An AI assistant reads it with the MCP tool get_report and the id entra.devices.inactive. The client needs the Read grant for Entra ID. See Using the API.