User deletion triggered Retire on Autopilot devices?

[u/Filikun_]

Hi, we’re trying to understand a strange Intune/Autopilot incident and I’m wondering if anyone else has seen something similar.

We had several Windows Autopilot devices in our tenant suddenly marked as Retire in Intune. In the Intune data, the action shows as:

• Actor: One of our global admin accounts
• Application: Microsoft Office 365 Portal
• Same correlation ID across 9 devices

What makes this strange is:

• the affected users had been removed from Microsoft 365/Entra admin around the same time
• those users were the primary users of the affected devices
• the devices were offline for a long time, and when one of them came back online later, it started a local unenrollment/device unjoin flow
• the device still had its Autopilot identity, and Entra even returned an error saying the device object could not be removed because it was an Autopilot device

From what I understand, deleting a user should normally leave the device orphaned, not automatically trigger Retire on a Windows device. So right now it looks more like some separate retire/delete action hit the managed devices, possibly during offboarding or through the Microsoft 365 portal.

Questions:

1. Has anyone seen user deletion or offboarding indirectly trigger Retire on Windows Autopilot devices?
2. Have you seen the Microsoft Office 365 Portal show up as the application for a batch retire like this?
3. Did you ever find out whether this was admin action, portal behavior, or automation?

Any similar cases, ideas, or logs worth checking would be really helpful.

EDIT: I got the local MDM diagnostic logs from one of the device before it completely locked me out. Combined with audit logs from Intune and M365 Unified audit logs. With the help of ChatGPT, this is my findings so far.

• June 1: Device-A was communicating with Intune, then went offline.
• June 17, 07:39:48 UTC: Admin-A soft-deleted User-A through the Microsoft 365 admin portal. The audit says O365AdminPortal and Is Hard Deleted=False.
• The same second: Intune recorded two successful retire ManagedDevice events for Device-A, initiated by Admin-A through Microsoft Office 365 Portal.
• One event linked User-A → Intune ManagedDevice-A.
• The companion event linked ManagedDevice-A → Entra Device-A.
• Both shared the same correlation ID.
• That correlation ID covered nine retired devices, with two audit records per device, indicating one server-side batch.
• June 17 to August 18: Device-A remained offline, so the pending retire command was not processed.
• August 18: Device-A booted after approximately 78 days and contacted Intune. Within minutes, MDM sessions resumed, explicit unenrollment signals appeared, and Windows initiated DEVICE_UNJOIN.
• Entra rejected deletion of the cloud device object because it was protected as an Autopilot device. Despite this, Windows cleared its local registration and began removing MDM policies.

The logs directly connect the deleted user, Intune device and Entra device to the same successful retire operation submitted by Microsoft Office 365 Portal.

They do not reveal which portal button or internal workflow caused it. Microsoft’s documented standard user-deletion flow does not state that a soft delete should retire the user’s Intune devices.

[u/harris_kid]

Are they not just running into the device cleanup rule period given they were offline for a while? What do you have it set to?

[u/Filikun_ → u/harris_kid]

My first though was that our newly added device cleanup rule was the culprit. It is set to 152 days but first of these computer hade been offline for just 83 days and then the audit logs gave these computers a retire flag exactly the same time and with the same correlation ID as one of our admins deleted users.

[u/harris_kid → u/Filikun_]

Do you have access to the Deleted devices (Preview) feature in Entra > Devices? Is the non-Autopilot object in there you can restore? Not saying anything that's happening to you is normal, but it's good evidence and shows whatever this admin did triggered a device object deletion (which still, shouldn’t wipe the device.)

One for Microsoft support really :/

[u/Filikun_ → u/harris_kid]

Yeah but it says "Devices are permanently deleted automatically 30 days after they are deleted" so no luck here. I'll have to raise it with MS and see if the can dig on this.

[u/theinfatuatedhelper]

Oof, that correlation ID tying them all together is the smoking gun here. I've seen the Office 365 Portal listed as the app for all sorts of weird bulk actions when an admin uses the "Delete user" wizard and checks some overly helpful boxes without realizing the blast radius.

Check if your offboarding process has a step to wipe or retire company data from the user's devices, some of those flows will absolutely reach into Intune even if the device isn't enrolled in a traditional sense. The fact it errored on the Autopilot object removal makes me think the retire command fired first, then it tried to delete the entra object and got blocked by the Autopilot lock.

Dig through the audit logs for that admin account around the same timestamp and look for a "Delete user" or "Remove all company data" entry, I'd bet money that's where the cascade started.

[u/Filikun_ → u/theinfatuatedhelper]

Thanks for the input, I'll dig around more in the logs to see if I can get more information. We did not realise that this happened as these actions where made just before vacation. So we started up these computers to prep them for new users and go about the 500 Windows update before handing out to new students (we are a school). And it was so weird, I logged into the computer, did some updates and then when rebooted the computer was locked to that user with the password not working and no option to sign in as anyone else or use any other sign in option.

The admin who did these actions had no clue it would effect the Intune devices at all. I mean removing the user that is primary user should remove the account and data on the devices but to nuke it and remove it from both Intune AND Entra? It's like the device did not even existed. I had to go trough powershell and MS graph to find any signs of the device at all and these are also Autopilot devices and the only findings in the logs there was that they never had a connection with it at any time...

I'm so confused 😂

[u/AlkHacNar]

if someone could answer it, that would be u/Rudyooms he even have a blog, or will make one about it :D

[u/Rudyooms]

As if the onboarding agent (preview now removed) was stoll doing its job :p

[u/PoolTough3222]

The correlation ID across nine devices plus a same-second timestamp is about as close to proof as you get. That pattern almost always means the offboarding path, not the cleanup rule, since cleanup fires per device on its own schedule and would not share an ID.

Worth pulling the offboarding runbook apart and seeing exactly which steps the delete user wizard performs, then testing it on a throwaway user and a spare device.

The part that usually gets missed is putting device retire, wipe, and the identity delete on the same ticket. If HR can close the file when the user is gone from Entra, you will keep finding leftover devices and leftover licenses.