The cleanest Intune portal is not necessarily the healthiest device estate. A record can be stale because a device was replaced, rebuilt, offline for legitimate reasons, or managed through a different channel. It can also be the only remaining evidence that a device still has a BitLocker recovery key or an Entra identity.
A guest account is the technical trace of a business relationship. Removing old guests can be useful, but a date field alone cannot tell you whether a supplier engagement, project, legal matter, or shared workspace is still active.
The useful question is not “when did this guest last sign in?” It is “what does this person still have access to, who sponsored it, and when should that access end?” A guest can be inactive and still be the only external owner of a shared artefact. A recently active guest can still have access that is no longer justified.
An Entra application called test, old, or do-not-use is not evidence that it is safe to remove. The same is true in reverse: a reassuring display name does not make an application safe. Start with what the workload identity can do, how it authenticates, and who can explain its purpose.