Device actions and lifecycle¶
Devices arrive, change hands, get lost and eventually leave. This guide covers the remote actions Intune gives you and the order to use them in, so you don't lose data or leave orphaned records behind.
The actions that remove things¶
These three are the most misunderstood, and the most dangerous.
| Action | What happens | Data | Device record |
|---|---|---|---|
| Retire | Removes company apps, data, profiles and settings, and unenrolls the device at its next check-in | Personal data stays | Removed after the device checks in |
| Wipe | Factory resets the device | Everything is erased (Windows can optionally keep the enrollment state and user account) | Stays until you delete it |
| Delete | Hides the device from the admin center immediately and triggers a retire (or a wipe on Android corporate and AOSP devices) | Depends on the platform | Removed immediately |
Things to know:
- Retire, Wipe and Delete override everything else. If a device has several pending actions, only the retire, wipe or delete runs.
- Daily tenant limits apply across the admin center, bulk actions and Graph: 500 wipes, 1,000 retires and 1,000 deletes per day. Contact Microsoft support if you need more.
- Bulk device actions (Devices > All devices > Bulk device actions) work on up to 100 devices at once.
- Put wipe, retire and delete behind Multi Admin Approval.
Before retiring or deleting an Entra joined Windows device
Retiring or deleting the Intune record of an Entra joined Windows device removes BitLocker key protectors and leaves BitLocker suspended. Deleting the device from Entra ID deletes its escrowed BitLocker keys and its LAPS password. If you might need the data or local access, record the BitLocker recovery key and LAPS password first.
Other remote actions¶
| Action | Platforms | Use for |
|---|---|---|
| Sync | All | Make the device check in now |
| Restart | Windows, macOS, supervised iOS/iPadOS | Apply pending changes |
| Fresh Start | Windows | Reinstall Windows and remove OEM bloatware, optionally keeping user data. The device stays enrolled and joined. |
| Autopilot reset | Windows (Entra joined, Autopilot registered) | Return a device to business-ready for a new user, keeping enrollment |
| Remote lock | iOS/iPadOS, Android, macOS | Lock a lost device. On macOS you set a 6-digit PIN that's needed to unlock. |
| Reset passcode | Android, iOS/iPadOS | User forgot their device passcode |
| Lost mode and Locate device | Supervised iOS/iPadOS; Android fully managed | Show a message and phone number, and find the device |
| Collect diagnostics | Windows | Upload a log bundle (MDM, Autopilot, IME and event logs) to Intune for download |
| Rotate BitLocker keys / Rotate local admin password / Rotate FileVault key | Windows, macOS | After a key or password has been used or exposed |
| Run remediation | Windows | Run a remediation script package now on one device |
| Rename device | Windows, macOS, supervised iOS/iPadOS | Fix names. Windows applies the new name after a restart. |
| Defender scans and signature updates | Windows | Quick or full scan, update security intelligence |
| New Remote Help session | Windows, macOS, Android | Screen sharing and control, with Remote Help licensing |
| Change primary user | Windows, macOS, iOS/iPadOS, Android | After reassigning a device, so user-based reports and Company Portal are right |
Track action status under Devices > Device actions. A Completed delete means the service finished, not that the device completed its retire.
When someone leaves¶
Work with your identity team so the steps happen in the right order:
- Identity first. Disable the account and revoke sessions in Entra ID. This cuts off access immediately, even on devices you haven't wiped yet.
- Corporate devices coming back to IT:
- Record the BitLocker recovery key and LAPS password if any data might be needed.
- For reuse: Autopilot reset (Windows) or Wipe (all platforms). Then change the primary user when the device is reassigned.
- Personal devices: Retire enrolled devices, and use Apps > App selective wipe for app-protected apps on unenrolled devices.
- Licenses last. Remove the user's licenses only after the device actions have completed.
Retiring hardware for good¶
When a device leaves the organization (end of lease, sale, disposal):
- Wipe it.
- Delete it from Intune.
- Release it from the vendor programs: deregister it from Windows Autopilot, release it from Apple Business (this permanently removes it from Automated Device Enrollment), or remove it from zero-touch or Knox.
- Delete the device object in Entra ID, and the computer account in Active Directory if it was hybrid joined.
Skipping step 3 means the next owner's device shows your company's sign-in screen after every reset.
Lost or stolen devices¶
| Platform | First steps | If it isn't coming back |
|---|---|---|
| iOS/iPadOS | Lost mode (supervised) with a contact number, then Locate device | Wipe |
| Android | Remote lock, reset passcode, locate (fully managed) | Wipe (corporate) or retire (personal work profile) |
| macOS | Remote lock with a PIN | Wipe |
| Windows | No remote lock. BitLocker protects data at rest. Disable the device in Entra ID and revoke the user's sessions. | Wipe, then rotate keys and passwords if the device is ever recovered |
In every case, revoke the user's sessions in Entra ID: device actions only run when the device comes online, but session revocation takes effect at once.
Device cleanup rules¶
Devices that stop checking in (reimaged, broken, lost, replaced) linger in reports and inflate your numbers. Device cleanup rules hide them automatically.
Create them under Devices > Organize devices > Device cleanup rules:
- One rule per platform, plus an optional All platforms rule. If both apply, the one with fewer days wins.
- Inactivity threshold: 30 to 270 days. 90 days suits most fleets. Use Preview affected devices before you save.
- Cleanup only hides the device record. It doesn't wipe or retire anything, and it doesn't touch Entra ID.
- A cleaned-up device that checks in again before its management certificate expires reappears. After the certificate expires, it has to re-enroll.
- Audit logs record each device hidden by a rule.
Entra ID needs its own cleanup of stale device objects. Disable devices that haven't signed in for a set period, then delete them later. See Manage stale devices in Entra ID.