| title | Remote Device Actions - Wipe, Lock, Locate, and More |
|---|---|
| description | Discover how to use Microsoft Intune to remotely manage, wipe, lock, restart, and secure Android, iOS/iPadOS, macOS, Windows, and ChromeOS devices. Learn about available remote actions, prerequisites, and bulk actions for IT admins. |
| ms.date | 03/09/2026 |
| ms.topic | overview |
In today's hybrid work environment, IT professionals manage and secure devices across diverse locations and platforms—often without physical access. Microsoft Intune's remote device actions provide a powerful toolkit to meet this challenge. These actions enable IT pros to respond quickly to incidents, enforce compliance, and maintain productivity, all from the cloud. Whether it's locking a lost device, resetting a password, or triggering a malware scan, remote actions help ensure that users stay protected and supported—wherever they are.
Remote actions are especially valuable in scenarios where time and access are limited. For example:
- A device is reported lost or stolen—IT can remotely wipe or lock it to protect sensitive data.
- A device is malfunctioning—IT can restart it or run diagnostics without needing to be on-site.
- A device needs to receive a payload immediately—IT can trigger a sync to apply the latest policies.
- A malware alert is raised—security teams can initiate a Defender Antivirus scan remotely.
These capabilities reduce downtime, improve security posture, and streamline support operations.
Each remote action has its own prerequisites, which the respective documentation details. In general:
- Devices must be enrolled in Intune.
- Devices must be connected to the Internet to receive remote commands.
- Some actions might require specific Intune roles or permissions.
Microsoft Intune supports remote device actions across multiple platforms. The availability of specific actions depends on the platform and the device's configuration. This cross-platform support ensures that IT pros can manage a diverse device ecosystem with consistent tools and workflows.
Select one of the following tabs to learn more about the available remote actions for each platform:
| Icon | Action | Description |
|---|---|---|
| :::image type="icon" source="icons/autopilot-reset.svg" border="false"::: | Autopilot reset | Restores a device to its original settings and removes personal files, apps, and settings. |
| :::image type="icon" source="icons/bitlocker-key-rotation.svg" border="false"::: | BitLocker key rotation | Rotates the BitLocker recovery key for a device. |
| :::image type="icon" source="icons/collect-diagnostics.svg" border="false"::: | Collect diagnostics | Collects diagnostic logs from a device and uploads the logs to Intune. |
| :::image type="icon" source="icons/delete.svg" border="false"::: | Delete | Removes a device from Intune management, removes any company data, and retires the device. |
| :::image type="icon" source="icons/fresh-start.svg" border="false"::: | Fresh Start | Reinstalls the latest version of Windows on a device and removes apps that the manufacturer installed. |
| :::image type="icon" source="icons/full-scan.svg" border="false"::: | Full Scan | Initiates a full scan of the device by Microsoft Defender Antivirus. |
| :::image type="icon" source="icons/locate-device.svg" border="false"::: | Locate device | Shows the approximate location of a device on a map. |
| :::image type="icon" source="icons/pause-config-refresh.svg" border="false"::: | Pause Config Refresh | Pauses ConfigRefresh to run remediation on a device for troubleshooting or maintenance or to make changes. |
| :::image type="icon" source="icons/quick-scan.svg" border="false"::: | Quick Scan | Initiates a quick scan of the device by Microsoft Defender Antivirus. |
| :::image type="icon" source="icons/new-remote-assistance-session.svg" border="false"::: | New remote assistance session | Allows you to remotely control a device by using Remote Help or TeamViewer. |
| :::image type="icon" source="icons/rename-device.svg" border="false"::: | Rename device | Changes the device name in Intune. |
| :::image type="icon" source="icons/restart.svg" border="false"::: | Restart | Restarts a device. |
| :::image type="icon" source="icons/retire.svg" border="false"::: | Retire | Removes company data and settings from a device, and leaves personal data intact. |
| :::image type="icon" source="icons/rotate-local-admin-password.svg" border="false"::: | Rotate Local admin password | Changes the local administrator password for a device and stores the password in Intune. |
| :::image type="icon" source="icons/run-remediation.svg" border="false"::: | Run remediation | Initiates on demand Proactive Remediation |
| :::image type="icon" source="icons/sync.svg" border="false"::: | Sync | Syncs a device with Intune to apply the latest policies and configurations. |
| :::image type="icon" source="icons/update-windows-defender-security-intelligence.svg" border="false"::: | Update Windows Defender security intelligence | Updates the security intelligence files for Microsoft Defender Antivirus. |
| :::image type="icon" source="icons/wipe.svg" border="false"::: | Wipe | Restores a device to its factory settings and removes all data and settings. |
Tip
For Intel vPro devices, Intune also integrates with Intel vPro Fleet Services to provide hardware-level remote management capabilities, including out-of-band management that works even when the operating system is unresponsive or the device is powered off.
| Icon | Action | Description |
|---|---|---|
| :::image type="icon" source="icons/delete.svg" border="false"::: | Delete | Removes a device from Intune management, removes any company data, and retires the device. |
| :::image type="icon" source="icons/disable-activation-lock.svg" border="false"::: | Disable Activation Lock | Removes the Activation Lock from a device that's enrolled with a device enrollment manager (DEM) account. |
| :::image type="icon" source="icons/locate-device.svg" border="false"::: | Locate device | Shows the approximate location of a device on a map. |
| :::image type="icon" source="icons/logout-current-user.svg" border="false"::: | Logout current user | Signs out the current user from a Shared iPad. |
| :::image type="icon" source="icons/lost-mode.svg" border="false"::: | Lost mode | Locks a device with a custom message and disables sound and vibration. |
| :::image type="icon" source="icons/new-remote-assistance-session.svg" border="false"::: | New remote assistance session | Allows you to remotely control a device by using Remote Help or TeamViewer. |
| :::image type="icon" source="icons/play-lost-mode-sound.svg" border="false"::: | Play Lost Mode sound | Plays Lost Mode sound on a lost device to help locate it. |
| :::image type="icon" source="icons/remote-lock.svg" border="false"::: | Remote lock | Locks a device and resets its password. |
| :::image type="icon" source="icons/remove-apps-and-configuration.svg" border="false"::: | Remove apps and configuration | Temporarily removes applications and configuration from a device. |
| :::image type="icon" source="icons/remove-user.svg" border="false"::: | Remove user | Deletes a user from the cache of a Shared iPad. |
| :::image type="icon" source="icons/rename-device.svg" border="false"::: | Rename device | Changes the device name in Intune. |
| :::image type="icon" source="icons/reset-passcode.svg" border="false"::: | Remove passcode | Removes the device passcode. |
| :::image type="icon" source="icons/restart.svg" border="false"::: | Restart | Restarts a device. |
| :::image type="icon" source="icons/retire.svg" border="false"::: | Retire | Removes company data and settings from a device, and leaves personal data intact. |
| :::image type="icon" source="icons/send-custom-notification.svg" border="false"::: | Send custom notification | Sends a custom notification message to a device that can be viewed in the Company Portal app. |
| :::image type="icon" source="icons/sync.svg" border="false"::: | Sync | Syncs a device with Intune to apply the latest policies and configurations. |
| :::image type="icon" source="icons/update-cellular-data-plan.svg" border="false"::: | Update cellular data plan | Updates the cellular data plan settings for a device that uses an eSIM profile. |
| :::image type="icon" source="icons/wipe.svg" border="false"::: | Wipe | Restores a device to its factory settings and removes all data and settings. |
| Icon | Action | Description |
|---|---|---|
| :::image type="icon" source="icons/delete.svg" border="false"::: | Delete | Removes a device from Intune management, removes any company data, and retires the device. |
| :::image type="icon" source="icons/disable-activation-lock.svg" border="false"::: | Disable Activation Lock | Removes the Activation Lock from a device that's enrolled with a device enrollment manager (DEM) account. |
| :::image type="icon" source="icons/new-remote-assistance-session.svg" border="false"::: | New remote assistance session | Allows you to remotely control a device by using Remote Help or TeamViewer. |
| :::image type="icon" source="icons/remote-lock.svg" border="false"::: | Remote lock | Locks a device and resets its password. |
| :::image type="icon" source="icons/rename-device.svg" border="false"::: | Rename device | Changes the device name in Intune. |
| :::image type="icon" source="icons/restart.svg" border="false"::: | Restart | Restarts a device. |
| :::image type="icon" source="icons/retire.svg" border="false"::: | Retire | Removes company data and settings from a device, and leaves personal data intact. |
| :::image type="icon" source="icons/rotate-filevault-recovery.svg" border="false"::: | Rotate FileVault recovery key | Rotates the FileVault recovery key. |
| :::image type="icon" source="icons/rotate-recovery-lock.svg" border="false"::: | Rotate Recovery Lock passcode | Rotates the Recovery Lock passcode. |
| :::image type="icon" source="icons/sync.svg" border="false"::: | Sync | Syncs a device with Intune to apply the latest policies and configurations. |
| :::image type="icon" source="icons/wipe.svg" border="false"::: | Wipe | Restores a device to its factory settings and removes all data and settings. |
| Icon | Action | Description |
|---|---|---|
| :::image type="icon" source="icons/delete.svg" border="false"::: | Delete | Removes a device from Intune management, removes any company data, and retires the device. |
| :::image type="icon" source="icons/locate-device.svg" border="false"::: | Locate device | Shows the approximate location of a device on a map. |
| :::image type="icon" source="icons/new-remote-assistance-session.svg" border="false"::: | New remote assistance session | Allows you to remotely control a device by using Remote Help or TeamViewer. |
| :::image type="icon" source="icons/play-lost-mode-sound.svg" border="false"::: | Play lost device sound | Plays a sound on a lost device to help locate it. |
| :::image type="icon" source="icons/remote-lock.svg" border="false"::: | Remote lock | Locks a device and resets its password. |
| :::image type="icon" source="icons/remove-apps-and-configuration.svg" border="false"::: | Remove apps and configuration | Temporarily removes applications and configuration from a device. |
| :::image type="icon" source="icons/rename-device.svg" border="false"::: | Rename device | Changes the device name in Intune. |
| :::image type="icon" source="icons/reset-passcode.svg" border="false"::: | Reset passcode | Resets the device passcode. |
| :::image type="icon" source="icons/restart.svg" border="false"::: | Restart | Restarts a device. |
| :::image type="icon" source="icons/retire.svg" border="false"::: | Retire | Removes company data and settings from a device, and leaves personal data intact. |
| :::image type="icon" source="icons/send-custom-notification.svg" border="false"::: | Send custom notification | Sends a custom notification message to a device that can be viewed in the Company Portal app. |
| :::image type="icon" source="icons/sync.svg" border="false"::: | Sync | Syncs a device with Intune to apply the latest policies and configurations. |
| :::image type="icon" source="icons/wipe.svg" border="false"::: | Wipe | Restores a device to its factory settings and removes all data and settings. |
Note
To manage ChromeOS devices with Intune, you must first set up the Chrome Enterprise connector and enroll devices by using the Google Admin console. This integration allows you to manage ChromeOS devices alongside other platforms in Intune.
| Icon | Action | Description |
|---|---|---|
| :::image type="icon" source="icons/retire.svg" border="false"::: | Deprovision | Removes Google Admin policies from a ChromeOS device that you no longer use. |
| :::image type="icon" source="icons/lost-mode.svg" border="false"::: | Lost mode | Locks a lost or stolen ChromeOS device and displays a custom message and contact info configured in the Google Admin Console. In Chrome Enterprise, this action is referred to as Disabled. |
| :::image type="icon" source="icons/restart.svg" border="false"::: | Restart | Restarts a device. |
| :::image type="icon" source="icons/wipe.svg" border="false"::: | Wipe | Erases data from the device. You can choose to remove only user profiles or perform a full factory reset (Powerwash). A factory reset is required before re-enrollment. |
Every remote device action has its own steps, which the respective documentation details. In general:
- In the Microsoft Intune admin center, select Devices > All devices.
- From the devices list, select a device.
- At the top of the device overview pane, a row displays available remote actions. Each icon represents a specific action (such as Restart, Wipe, or Locate device). Depending on your screen resolution or window size, the overflow menu (...) might hide some actions.
- Select the desired action.
- Complete any required fields, then confirm the action.
Note
The Retire, Wipe, and Delete actions take precedence over all other actions. A device with multiple pending actions only carries out a Retire, Wipe, or Delete. The system ignores all other pending actions.
To check the status of the remote action, select Devices > Device actions.
Managing devices at scale is a common challenge for IT pros, especially in environments like schools, enterprises, or frontline operations. Microsoft Intune supports bulk remote actions, so IT admins can perform tasks on up to 100 devices at the same time. This capability streamlines operations, reduces manual effort, and ensures consistent policy enforcement across large device fleets.
For example, at the end of a school year, IT admins can use bulk wipe to securely reset student devices before reassigning them for the next term. This approach saves time and ensures that sensitive data is removed efficiently across all devices.
Select one of the following tabs to learn more about the available bulk remote actions for each platform:
| Bulk action | Description |
|---|---|
| Autopilot reset | Restores a device to its original settings and removes personal files, apps, and settings. |
| Collect diagnostics | Collects diagnostic logs from a device and uploads the logs to Intune. |
| Delete | Removes a device from Intune management, removes any company data, and retires the device. |
| Rename | Changes the device name in Intune. |
| Restart | Restarts a device. |
| Retire | Removes company data and settings from a device, and leaves personal data intact. |
| Sync | Syncs a device with Intune to apply the latest policies and configurations. |
| Wipe | Restores a device to the factory settings and removes all data and settings. |
| Bulk action | Description |
|---|---|
| Delete | Removes a device from Intune management, removes any company data, and retires the device. |
| Rename | Changes the device name in Intune. |
| Restart | Restarts a device. |
| Retire | Removes company data and settings from a device, and leaves personal data intact. |
| Send custom notification | Sends a custom notification message to a device that can be viewed in the Company Portal app. |
| Sync | Syncs a device with Intune to apply the latest policies and configurations. |
| Update cellular data plan | Updates the cellular data plan settings for a device that uses an eSIM profile. |
| Wipe | Restores a device to its factory settings and removes all data and settings. |
| Bulk action | Description |
|---|---|
| Delete | Removes a device from Intune management, removes any company data, and retires the device. |
| Rename device | Changes the device name in Intune. |
| Restart | Restarts a device. |
| Retire | Removes company data and settings from a device, and leaves personal data intact. |
| Sync | Syncs a device with Intune to apply the latest policies and configurations. |
| Wipe | Restores a device to its factory settings and removes all data and settings. |
| Bulk action | Description |
|---|---|
| Delete | Removes a device from Intune management, removes any company data, and retires the device. |
| Rename | Changes the device name in Intune. |
| Restart | Restarts a device. |
| Wipe | Restores a device to its factory settings and removes all data and settings. |
| Bulk action | Description |
|---|---|
| Deprovision | Removes Google Admin policies from a ChromeOS device that you no longer use. |
| Lost mode | Locks a lost or stolen ChromeOS device and displays a custom message and contact info configured in the Google Admin Console. In Chrome Enterprise, this action is referred to as Disabled. |
| Restart | Restarts a device. |
| Wipe | Erases data from the device. You can choose to remove only user profiles or perform a full factory reset (Powerwash). A factory reset is required before re-enrollment. |
Each bulk remote action has its own steps. The documentation for each action provides detailed instructions. In general, follow these steps:
- In the Microsoft Intune admin center, select Devices > All devices > Bulk device actions.
- On the Basics page, select an OS and Device action from the dropdowns. Some device actions have more options or fields to fill in. Select Next.
- On the Devices page, select up to the maximum number of devices that the action supports. Select Next.
- On the Review + create page, select Create.
Remote device actions in Intune empower IT pros to manage devices efficiently and securely—whether individually or at scale. Explore the documentation linked in this article to learn more about each action and how to integrate them into your device management workflows.