The number on your Intune device report is not the number of devices you manage. It is the number of device records Intune is currently willing to show you, which is a different thing. The usual reason the two diverge is device cleanup rules: a cleanup rule hides a stale device record from the Intune portal and from reports, but it does not delete the device, does not wipe or retire it, and does not remove the matching device object from Microsoft Entra ID. Add reporting latency, scope tags and failed enrolments on top and it is normal for Intune, Entra and your asset list to return three different totals on the same afternoon. None of them is broken. They count different things, and the fix is knowing which is which before somebody asks you to prove a coverage figure.
Three counts that should agree, and rarely do
The Intune count is managed device records your account is allowed to see, as of whenever the report was last generated. It answers "how many enrolled devices are visible to me".
The Microsoft Entra ID count is identity records, created when a device is joined, hybrid joined or registered. Plenty belong to devices never enrolled in Intune, and a machine that is rebuilt or reimaged can leave a duplicate behind, sometimes in a Pending state. Entra answers "how many device identities exist in the directory".
Your asset list is the only one that includes the laptop in a drawer, unopened since March. It answers "what do we own".
Hidden is a display state, not a deletion: the device, its policies and its Entra object all carry on.
Cleanup rules hide devices, they do not delete them
Microsoft documents this plainly, and the current Intune article is titled around hiding rather than deleting. Cleanup rules run on a schedule and automatically hide records of devices that have not checked in for a period you set. Microsoft Learn states that they hide devices from the Intune portal and reports, do not trigger any action on the device such as a wipe or retire, allow cleaned-up devices to reappear if they check in before their device certificate expires, require re-enrolment once that certificate has expired, and are not available for Jamf-managed devices.
You configure them under Devices, then Organize devices, then Device cleanup rules. Two details matter when reconciling. First, the day value: in Rule settings you enter a number between 30 and 270 for how long a device may go without checking in before it counts as stale. Second, precedence: if both a platform-specific rule and an All platforms rule exist, the one with fewer days is applied. You get one rule per platform, across Windows, macOS, iOS/iPadOS, the Android variants, ChromeOS, Windows Holographic, visionOS and tvOS. Before saving, Preview affected devices shows which records the rule would catch, which is the cheapest way to find out how large your hidden population is about to become.
Be clear what "checked in" means, because it is not "somebody used it". Intune maintenance syncs run on an estimated schedule of around every eight hours across platforms, with devices allowed one maintenance sync every six and a half hours. Newly enrolled devices sync far more often at first, for example Windows and Android every three minutes for fifteen minutes, then every fifteen minutes for two hours. A machine that is on and online checks in many times a week, so reaching even the 30-day floor takes real absence.
Creating these rules needs the Intune Administrator role or a custom role with the Managed Device Cleanup Rules and Managed Device Cleanup Settings update permissions. They do not change by accident. They do change quietly.
What "hidden" means downstream
Hidden means hidden from you, not gone from the estate. The record is suppressed in the portal and in reports, and nothing is sent to the device. That laptop in the cupboard is still enrolled, still carrying its assigned configuration and compliance policies, and still holding whatever organisational data was on it.
The comfortable consequence is that a returning device heals itself: it checks in and, provided its device certificate has not expired, the record reappears. The uncomfortable one is that any percentage you quote is a percentage of visible devices. "Ninety-eight per cent compliant" is true about the population Intune is showing you, and says nothing about the records a cleanup rule removed from the denominator.
The Entra device object is a separate job
Microsoft is explicit that devices hidden from Intune are not removed from Microsoft Entra ID. Directory hygiene is its own piece of work with its own clock.
Entra judges staleness from the activity timestamp, ApproximateLastSignInDateTime, and it is deliberately coarse. It is evaluated when a Conditional Access policy requiring managed devices or approved client apps is triggered, when Windows 10 or newer Entra joined or hybrid joined devices are active on the network, and when Intune managed devices check in. The stored value is only replaced when the delta exceeds 14 days, with a variance of plus or minus 5 days, which is why the guidance says not to treat a timestamp younger than 21 days as an indicator of staleness.
The recommended cleanup pattern is conservative for good reason. Retire MDM-controlled devices in the management system first, disable a device for a grace period rather than deleting it, and only then remove it, because deletion cannot be undone. Before deleting, confirm BitLocker recovery keys are backed up or no longer needed, since keys on the device object go with it, and check the list against Windows Autopilot, because removing an Autopilot-associated Entra object can break later self-deploying and pre-provisioning deployments.
A short reconciliation shows the size of the problem.
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All","Device.Read.All"
$intune = Get-MgDeviceManagementManagedDevice -All
$entra = Get-MgDevice -All
Write-Host "Intune managed device records:" $intune.Count
Write-Host "Entra device objects:" $entra.Count
$quiet = $intune.Where({ $_.LastSyncDateTime -lt (Get-Date).AddDays(-30) })
Write-Host "No Intune check-in for 30 days:" $quiet.Count
$idle = $entra.Where({ $_.ApproximateLastSignInDateTime -lt (Get-Date).AddDays(-90) })
Write-Host "Entra objects with no activity in 90 days:" $idle.Count
Other reasons the number moves
Reporting latency. Intune organises reports into operational, organisational, historical and specialist types, and they do not refresh the same way. The Device compliance report is generated on demand and carries a timestamp of when it was last generated, so two people running it an hour apart legitimately get different numbers. Microsoft also notes reports can lag the device in reflecting the latest policy status.
Scope tags and role assignments. Roles determine what access admins have to which objects; scope tags determine which objects admins can see. An administrator whose role assignment carries no scope tag effectively has all of them. Give one operator a regional tag and their total will be smaller than yours, correctly.
Filters left in the view. Search terms and filters applied to a report are carried into the export, which is an easy way to circulate a filtered number as though it covered the estate.
Enrolments that never completed. A device that failed to enrol never becomes an Intune record, though it may exist in Entra and certainly exists on your asset list. Devices, then Monitor, then Enrollment failures is where those attempts surface.
See exactly what was hidden
You do not have to infer any of this. Intune auditing is enabled for all customers and cannot be disabled, and cleanup activity is written to the audit log like any other change.
Go to Tenant administration, then Audit logs, and add an Activity filter for "Device set to be hidden from admin by Device Cleanup Rule", followed by your rule name. The date picker covers the previous year. To keep the evidence longer, export to CSV, route audit and operational logs to Azure Monitor, or pull audit events through Microsoft Graph, which returns two years of them. Run that filter quarterly and you have the missing line in your reporting: not just how many devices are visible, but how many stopped being visible and when.
Why it matters the moment somebody asks for evidence
A device count is rarely just a number. It is the denominator under encryption coverage, patch levels, MFA enforcement and every compliance percentage you hand to an assessor, a client or an insurer. If that denominator quietly shrinks each time a cleanup rule fires, your coverage improves for reasons unrelated to the estate getting safer.
Certification schemes probe exactly this area, and our Cyber Essentials v3.3 auto-fail checklist covers where a scoping answer sinks an assessment. The same discipline belongs in routine service reporting, alongside the other numbers in what MSPs should report every month, and next to leaver hygiene, since a closed account and a hidden device are two halves of the same tidy-up covered in the Microsoft 365 offboarding checklist.
Practically, write the count as a sentence rather than a figure: as at this date, this many enrolled records visible in Intune, this many hidden by cleanup rules this quarter, this many Entra device objects with no activity in ninety days, reconciled against this many assets on the register. That sentence is defensible. A screenshot of a tile is not.
Where EtherInsights fits
Doing this by hand across one tenant is an afternoon. Doing it monthly across twenty is a job, and that is the gap EtherInsights closes: it pulls the Intune, Entra and compliance views together, keeps the history so you can see when a count changed rather than only that it did, and turns the reconciliation into evidence you can hand over. For the endpoint side, Intune reporting and troubleshooting is the route covering device visibility, policy failures and the questions that start with "why does this device not appear".
The same reconciliation shows up inside Microsoft 365 security and conformity when coverage percentages have to hold up in front of an assessor, and inside IT operations and compliance when the question is whether the estate is run to a standard.
Your Intune device count is not wrong because something is broken. It is wrong because it answers a narrower question than the one you are being asked. Learn the mechanism, check what has been hidden, reconcile against Entra and the asset register, and quote a number you can stand behind.
Explore Intune reporting and troubleshooting to see how device visibility, policy failures and coverage evidence come together in one view.