Imperva Skyfence

The endpoint status request enables a client application to enroll an endpoint or revoke its enrollment. This is usually relevant for endpoints with pending status but can be done for endpoints with any current status. The endpoint needs to be specified by its ID, which can have been received from an endpoints list request, from a new endpoint notification, or from any other implemented manual or automated input.

Creating a schedule task that's call ImpSfRevokeUnaccessedDevices:
Getting all devices data from server, if a device haven't been accessed to in over two months (and is still managed), the script will send the corresponding user a warning mail.
If it's haven't been accessed to in over three months, the script will revoke the device credentials and notify the user by mail

The endpoints list request enables a client application to receive a list of all managed and unmanaged endpoints, with their basic details. This list can then be externally filtered or searched by the application to identify individual endpoints that might require action. For any such endpoint, the application can obtain fuller details (see Endpoint Details Request below) and if relevant change its enrollment status.

Getting all devices data from server, if a device haven't been accessed to in over two months (and is still managed), the script will send the corresponding user a warning mail.
If it's haven't been accessed to in over three months, the script will revoke the device credentials and notify the user by mail

The Imperva Skyfence Cloud Gateway is a Cloud Access Security Broker (CASB) that provides visibility and control over sanctioned and unsanctioned cloud apps to enable their safe and productive use.