Account for cached Intune scripts after Windows management ends

Source facts

Microsoft says the Intune Management Extension is not removed immediately when Windows management ends. At its next check-in, usually every eight hours, it detects the unmanaged state and cancels script runs. Locally stored scripts can run in the meantime. If it cannot check in, it retries for up to 24 hours of device-awake time before removing itself. Microsoft Learn.

Applicability

Use this review for a Windows device leaving management while scripts have been assigned. Identify the device’s actual connectivity and assigned script set before choosing the offboarding sequence.

DSE recommendation

Review pending script effects with the endpoint owner before ending management. Distinguish removal of the management relationship from evidence that the local agent has stopped executing work. Coordinate device custody and network availability for the planned handoff. Do not promise immediate cancellation on an offline device or use console record removal as proof that local execution has ceased.

Verification

Rehearse the transition on a nonproduction device with a harmless, observable test script. Record the management change, subsequent check-in or retry evidence, and the agent’s observed state. Check for unexpected script activity during the handoff interval and investigate it before reissuing the device. Preserve timestamps and script identities without retaining secrets or personal data. Close the task only against the agreed local-state evidence, not an assumed wall-clock delay.

Official references

Microsoft Learn: Add PowerShell Scripts to Windows Devices in Microsoft Intune.