4.3 Remote Actions and Bulk Actions
Key Takeaways
- Remote actions are one-time commands launched from Intune against managed devices; available actions depend on platform, management state, configuration, and RBAC permissions.
- Use Sync before disruptive actions when the goal is to force a device to check in and evaluate new policy or app assignments.
- Retire removes company data and settings while preserving personal data, while Wipe restores the device to factory settings and removes all data and settings.
- Bulk device actions can run supported actions against up to 100 devices at a time, but the supported bulk action list varies by platform.
- Retire, Wipe, and Delete take precedence over other pending actions, so they should be used deliberately and documented.
Remote actions as operational commands
A configuration profile defines desired state. A remote action is an admin-initiated command. Use remote actions when you need an immediate operation such as check-in, restart, diagnostics collection, device lock, retirement, wipe, or a support session.
Remote actions appear on a device's overview page in the Intune admin center. Some actions may be hidden in the overflow menu, and some are unavailable because of platform, enrollment type, device state, or admin permission. After you run an action, check Devices > Device actions for status.
What to use when
| Scenario | Best action | Why |
|---|---|---|
| A newly assigned policy must apply as soon as possible | Sync | Tells the device to check in with Intune and evaluate current assignments |
| A device is responsive but needs a reboot to complete maintenance | Restart | Restarts without changing management state or data |
| A BYOD user leaves the company | Retire | Removes company data and management settings while leaving personal data intact |
| A lost corporate device might contain sensitive data | Wipe | Restores factory settings and removes data and settings |
| A device object should no longer be managed or visible in Intune | Delete | Removes the device from Intune management and retires it |
| A Windows corporate device is being reassigned internally | Autopilot Reset | Removes personal files, apps, and settings while returning the device to a business-ready state |
| Help desk needs logs without asking the user to gather them | Collect diagnostics | Uploads troubleshooting files to Intune for investigation |
| A user needs guided support | New remote assistance session | Starts Remote Help or TeamViewer, depending on configuration |
Retire, wipe, delete, and reset
These actions are easy to confuse. The exam wording usually tells you the answer.
Retire is least destructive. Use it when the device is personal or when you only need to remove organization data and management. Wipe is destructive. Use it for lost, stolen, reassigned, or compromised corporate devices when factory reset is acceptable. Delete removes the Intune record and management relationship. Autopilot Reset is specific to returning a Windows device to a business-ready state while keeping it enrolled for reuse.
A useful decision sequence is:
- Is the device personal and the user is leaving? Use Retire.
- Is the device corporate and data must be removed? Use Wipe.
- Is the Windows device staying in the organization for a new user? Consider Autopilot Reset.
- Is the issue only delayed policy or app state? Use Sync first.
- Is evidence needed before changing the device? Use Collect diagnostics before destructive actions when possible.
Bulk actions
Bulk actions reduce repetitive work across fleets, classrooms, kiosks, and frontline devices. Intune supports bulk device actions for up to 100 devices at the same time. The supported bulk actions differ by platform. Windows bulk actions include choices such as Autopilot reset, Collect diagnostics, Delete, Rename, Restart, Retire, Sync, and Wipe. Apple, Android, macOS, and ChromeOS have their own supported lists.
Bulk actions are not the same as policy assignment. A policy keeps applying over time. A bulk action runs a command. Use policy for ongoing configuration, update rings, compliance, and app deployment. Use bulk action for a point-in-time operation such as wiping a student device set at the end of a school year.
One operational warning is especially testable: Retire, Wipe, and Delete take precedence over other pending actions. If a device has several queued commands, the destructive lifecycle action wins and the system ignores other pending actions. This is why high-impact actions should require a clear operational process, correct RBAC, and documentation.
You just assigned a configuration profile and need a managed Windows device to contact Intune immediately instead of waiting for its normal check-in. Which remote action should you try first?
A personally owned enrolled phone belongs to an employee who is leaving. The company needs to remove organization data but preserve personal photos and apps. Which action best fits?
Which statements about Intune bulk and remote actions are correct?
Select all that apply