Working on automating stale device/user cleanup in Entra ID — disable first, delete after a retention period. The PowerShell side is straightforward, but two things give me pause:

Audit trail: If someone asks three months later "why was this object removed and who triggered it?" — how do you document that properly? Roll your own DB/CSV logging, or is there something better?

BitLocker/LAPS: Deleting a device object also drops its BitLocker recovery keys. Do you back those up (and LAPS passwords) somewhere first, or does that risk stop you from automating at all?

Curious how people handle this today — plain script + homemade logging, an existing tool, or deliberately manual? Any war stories welcome.