The cleanest Intune portal is not necessarily the healthiest device estate. A record can be stale because a device was replaced, rebuilt, offline for legitimate reasons, or managed through a different channel. It can also be the only remaining evidence that a device still has a BitLocker recovery key or an Entra identity.
An Entra application called test, old, or do-not-use is not evidence that it is safe to remove. The same is true in reverse: a reassuring display name does not make an application safe. Start with what the workload identity can do, how it authenticates, and who can explain its purpose.
BYOAI is usually framed as shadow IT with a better user experience. Someone has a question, a deadline, or a document that needs improving. A public AI tool is one browser tab away. The risk is real, but the human need is real too.
A guest account is the technical trace of a business relationship. Removing old guests can be useful, but a date field alone cannot tell you whether a supplier engagement, project, legal matter, or shared workspace is still active.
The useful question is not “when did this guest last sign in?” It is “what does this person still have access to, who sponsored it, and when should that access end?” A guest can be inactive and still be the only external owner of a shared artefact. A recently active guest can still have access that is no longer justified.
An unlicensed or inactive OneDrive is not automatically disposable. It can contain project evidence, personal working files required for a case, or content subject to retention. “Orphaned” should be a conclusion from evidence, not a label created by a storage report.
Archiving a SharePoint site is a change to access, ownership, recovery, and compliance. Storage cost matters, but it is the last question I ask, not the first.
For each site, document the business purpose, accountable owner, last meaningful activity, external sharing, sensitivity and retention state, eDiscovery considerations, expected retrieval time, and future disposition date. “No recent edits” is a useful signal. It is not an archival decision by itself.
Large files are visible. Retention side effects often are not. That is why a storage incident can become a compliance incident when somebody responds by changing a policy before understanding what is preserving the content.
When SharePoint or OneDrive content is retained, Microsoft can preserve the original version in the Preservation Hold library after a user edits or deletes it. The user may see a file disappear while the tenant still retains a copy. Microsoft explains the workload-specific behaviour in retention for SharePoint and OneDrive.