Manage devices in Microsoft Entra ID using the Microsoft Entra admin center - Microsoft Entra ID (original) (raw)

Microsoft Entra ID provides a central place to manage device identities and monitor related event information.

Screenshot that shows the devices overview.

You can access the devices overview by completing these steps:

  1. Sign in to the Microsoft Entra admin center as a user with at least default user permissions.
  2. Go to Entra ID > Devices > Overview.

In the devices overview, you can view the number of total devices, stale devices, noncompliant devices, and unmanaged devices. It provides links to Intune, Conditional Access, BitLocker keys, and basic monitoring. Other features like Conditional Access and Microsoft Intune require additional role assignments

Device counts on the overview page don't update in real time. Changes should be reflected every few hours.

From there, you can go to All devices to:

Screenshot that shows the All devices view.

Tip

Manage an Intune device

If you have rights to manage devices in Intune, you can manage devices for which mobile device management is listed as Microsoft Intune. If the device isn't enrolled with Microsoft Intune, the Manage option isn't available.

Enable or disable a Microsoft Entra device

There are two ways to enable or disable devices:

Important

Delete a Microsoft Entra device

There are two ways to delete a device:

Important

If a device is managed in another management authority, like Microsoft Intune, be sure it's wiped or retired before you delete it. See How to manage stale devices before you delete a device.

View or copy a device ID

You can use a device ID to verify the device ID details on the device or to troubleshoot via PowerShell. To access the copy option, select the device.

Screenshot that shows a device ID and the copy button.

View or copy BitLocker keys

You can view and copy BitLocker keys to allow users to recover encrypted drives. These keys are available only for Windows devices that are encrypted and store their keys in Microsoft Entra ID. You can find these keys when you view a device's details by selecting Show Recovery Key. Selecting Show Recovery Key generates an audit log entry, which you can find in the KeyManagement category.

Screenshot that shows how to view BitLocker keys.

To view or copy BitLocker keys, you need to be the owner of the device or have one of these roles:

Note

When devices that utilize Windows Autopilot are reused, and there is a new device owner, that new device owner must contact an administrator to acquire the BitLocker recovery key for that device. Custom role or administrative unit scoped administrators will continue to have access to BitLocker recovery keys for those devices that have undergone device ownership changes, unless the new device owner belongs to a custom role or administrative unit scope. In such an instance, the user will need to contact other scoped administrator for the recovery keys. For more information, see the article Find the primary user of an Intune device.

View and filter your devices

You can filter the device list by these attributes:

Download devices

Cloud Device Administrators and Intune Administrators can use the Download devices option to export a CSV file that lists devices. You can apply filters to determine which devices to list. If you don't apply any filters, all devices are listed. The exported list includes these device identity attributes:

id,deviceId,isManaged,profileType,systemLabels,model,displayName,accountEnabled,operatingSystem,operatingSystemVersion,trustType(joinType),mdm,securitySettingsManagement,isCompliant,registrationDateTime,approximateLastSignInDateTime,owner,upnName

Note

trustType is where JoinType can be determined. A common translation is:

The following filters can be applied for the export task:

Additionally, columns can be managed by selecting Manage view > Columns to toggle which columns you would like to export.

Note

Selecting Owner or User principal name can make processing take longer. If you prefer faster results, leave these options unchecked; enable them when you need the extra information.

Configure device settings

If you want to manage device identities by using the Microsoft Entra admin center, the devices need to be either registered or joined to Microsoft Entra ID. As an administrator, you can control the process of registering and joining devices by configuring the following device settings.

You must be assigned one of the following roles to read or modify device settings:

Screenshot that shows device settings related to Microsoft Entra ID.

Audit logs

Device activities are visible in the activity logs. These logs include activities triggered by the device registration service and by users:

Note

When performing bulk operations, such as import or create, you can encounter a problem if the bulk operation doesn't complete within the hour. To work around this issue, we recommend splitting the number of records processed per batch. For example, before starting an export you could limit the result set by filtering on a group type or user name to reduce the size of the results. By refining your filters, essentially you limit the data returned by the bulk operation. For more information, see Bulk operations service limitations.

The entry point to the auditing data is Audit logs in the Activity section of the Devices page.

The audit log has a default list view that shows:

Screenshot that shows a table in the Activity section of the Devices page. The table shows the date, target, actor, and activity for four audit logs.

You can customize the list view by selecting Columns in the toolbar:

Screenshot that shows the toolbar of the Devices page.

To reduce the reported data to a level that works for you, you can filter it by using these fields:

You can also search for specific entries.

Screenshot that shows audit data filtering controls.

Next steps