📱 Recipe · Intune & Device Management
Identify Stale Intune Devices and Trigger a Remote Sync
Find managed devices that haven't checked into Intune recently and force a policy sync to bring them current
Complexity
Intermediate
Impact
device-management + compliance + fleet-hygiene + intune
Context
Why This Matters
Intune-managed devices periodically check in with the service to pull down configuration profiles, compliance policies, and app assignments. When a device stops checking in, it drifts out of compliance, misses security policy updates, and may appear healthy in reports while actually being unmanaged in practice.
This recipe identifies devices whose lastSyncDateTime is older than a cutoff you choose (for example, "since last Friday" or "more than 7 days ago") and issues a remote syncDevice action to each one. It's a common weekly hygiene task and a useful first response when users report that a new policy, app, or certificate hasn't arrived on their machine.
When to run it
- Weekly or daily as part of device fleet hygiene
- After pushing a high-priority configuration profile or compliance policy
- When investigating a rollout that appears stuck on a subset of devices
- Before generating compliance reports for auditors
Expected Outcomes
What you'll have after running this recipe
- A list of all Intune-managed devices whose last check-in is older than your chosen cutoff, including device name, assigned user, OS, and last sync timestamp
- A remote sync action queued against every stale device
- A run log you can attach to a ticket or change record showing which devices were targeted and whether the sync action was accepted by the service
- Reduced policy drift and faster convergence on your current Intune baseline
Risks & Considerations
Warnings and considerations
- Sync is a request, not a guarantee. The
syncDeviceaction only succeeds if the device is online and can reach Intune. Offline, retired, or decommissioned devices will stay stale no matter how many times you trigger a sync. - Truly abandoned devices need retirement, not sync. If a device has been offline for 30+ days, investigate whether it was lost, reimaged, or left the fleet. Consider using the retire or delete action instead.
- Watch for throttling. Graph throttles bulk device actions. For fleets larger than a few hundred stale devices, add delays between calls or batch them.
- Don't rely on
lastSyncDateTimealone for compliance decisions. A device that synced recently can still be non-compliant. UsecomplianceStatefor that signal. - Time zones matter.
lastSyncDateTimeis UTC. Ensure your cutoff is also computed in UTC or you'll drift by up to 24 hours. - Audit logging. Each sync action is recorded in the Intune audit log under the service principal or user that ran it. Use a documented service account for scheduled runs.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| DeviceManagementManagedDevices.Read.All | Enumerate managed devices and read lastSyncDateTime to identify stale devices |
| DeviceManagementManagedDevices.PrivilegedOperations.All | Invoke the syncDevice remote action against each stale device |
| DeviceManagementManagedDevices.ReadWrite.All | Required in many tenants alongside PrivilegedOperations for device action endpoints |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
Manual walkthrough — Microsoft Intune admin center
Use this approach for small fleets or one-off investigations. For more than a few dozen devices, use the API or PowerShell approach instead.
Step 1 — Open the devices list
Microsoft Intune admin center → Devices → All devices
Step 2 — Filter to stale devices
- Click Filter above the device list.
- Add a filter on Last check-in.
- Set the operator to Before and choose your cutoff date (for example, last Friday at 00:00).
- Optionally add OS or Compliance state filters to scope the list further.
- Click Apply.
Step 3 — Export the list (recommended)
Click Export to download the filtered device list as CSV. Keep this as evidence of what you targeted.
Step 4 — Trigger sync
- Select the checkbox next to each stale device (or use Select all on the current page).
- Click Sync in the command bar at the top of the list.
- Confirm the action in the dialog.
The portal only lets you act on the currently visible page. For multi-page results, either paginate through them or switch to the scripted approach.
Step 5 — Verify
Wait 10–30 minutes, refresh the device list, and check that Last check-in has updated for the devices that were online. Any device whose timestamp did not move is likely offline or unreachable — flag those for follow-up.
Graph API recipe
Two endpoints do the work: list managed devices, then invoke the sync action on each stale one.
1. List managed devices
GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?$select=id,deviceName,userPrincipalName,lastSyncDateTime,operatingSystem,complianceState
Authorization: Bearer {access_token}Follow @odata.nextLink until you've paged through the full fleet. Sample response item:
{
"id": "a1b2c3d4-...",
"deviceName": "LAPTOP-ABC123",
"userPrincipalName": "jane@contoso.com",
"lastSyncDateTime": "2026-02-10T14:22:18Z",
"operatingSystem": "Windows",
"complianceState": "compliant"
}2. Filter locally
Graph does not support $filter on lastSyncDateTime for managedDevices, so filter client-side. Keep any device where lastSyncDateTime is null or earlier than your cutoff (in UTC).
3. Trigger sync on each stale device
POST https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{deviceId}/syncDevice
Authorization: Bearer {access_token}
Content-Length: 0A successful call returns HTTP 204 No Content. The action is queued; the device picks it up on its next network check-in (typically within 8 hours for Windows, faster if the device is actively connected).
Common errors
403 Forbidden— missingDeviceManagementManagedDevices.PrivilegedOperations.All.404 Not Found— the device was deleted between list and action; skip it.429 Too Many Requests— honor theRetry-Afterheader and back off.
PowerShell approach
The downloadable script uses the Microsoft.Graph PowerShell SDK to enumerate devices, filter for stale ones, and invoke syncDevice on each. It supports a -WhatIf-style dry run and writes a CSV report.
Prerequisites
- PowerShell 7+ (Windows PowerShell 5.1 also works)
Install-Module Microsoft.Graph -Scope CurrentUser- An account or app registration with the permissions listed above, consented at the tenant level
How it works
- Connects to Graph with the required scopes.
- Pages through
/deviceManagement/managedDevicesselecting only the columns needed. - Filters for devices whose
LastSyncDateTimeis older than-StaleSince(default: 7 days ago in UTC). - If
-ReportOnlyis set, writes a CSV and exits. Otherwise, issuesInvoke-MgSyncDeviceManagementManagedDeviceagainst each stale device with a short delay between calls to avoid throttling. - Captures successes and failures and writes a summary CSV.
Usage examples
# Dry run — list stale devices older than last Friday, no action taken
.\Sync-StaleIntuneDevices.ps1 -StaleSince (Get-Date '2026-02-13T00:00:00Z') -ReportOnly
# Sync everything that hasn't checked in in the last 7 days
.\Sync-StaleIntuneDevices.ps1
# Sync only Windows devices stale > 3 days, write report to a custom path
.\Sync-StaleIntuneDevices.ps1 -StaleSince (Get-Date).AddDays(-3) -OperatingSystem Windows -ReportPath C:\Reports\intune-sync.csvAlways run with -ReportOnly first on a new tenant to confirm the target list looks right before issuing sync actions.
Next steps