4.3 Remote Actions and Bulk Actions
Key Takeaways
- Remote actions are one-time commands launched from Intune against managed devices; available actions depend on platform, management state, configuration, and RBAC permissions.
- Use Sync before disruptive actions when the goal is to force a device to check in and evaluate new policy or app assignments.
- Retire removes company data and settings while preserving personal data, while Wipe restores the device to factory settings and removes all data and settings.
- Bulk device actions can run supported actions against up to 100 devices at a time, but the supported bulk action list varies by platform.
- Retire, Wipe, and Delete take precedence over other pending actions, so they should be used deliberately and documented.
Remote actions as operational commands
A configuration profile defines desired state and is reapplied over time. A remote action is an admin-initiated, point-in-time command. Use remote actions when you need an immediate operation such as check-in, restart, diagnostics collection, device lock, retirement, wipe, or a support session. The exam contrast is steady: policy is ongoing configuration, a remote action is a one-time command.
Remote actions appear on a device's overview page in the Intune admin center. Some actions are hidden in the overflow menu, and some are unavailable because of platform, enrollment type, device state, or admin permission. RBAC matters: an admin can only run actions their role permits, so a scenario where "the action is missing" can be a permissions problem, not a product limitation. After you run an action, check Devices > Device actions status for the result, because an action can be queued, pending the next check-in, or failed.
What to use when
| Scenario | Best action | Why |
|---|---|---|
| A newly assigned policy must apply as soon as possible | Sync | Tells the device to check in with Intune and evaluate current assignments |
| A device is responsive but needs a reboot to complete maintenance | Restart | Restarts without changing management state or data |
| A BYOD user leaves the company | Retire | Removes company data and management settings while leaving personal data intact |
| A lost corporate device might contain sensitive data | Wipe | Restores factory settings and removes all data and settings |
| A device object should no longer be managed or visible in Intune | Delete | Removes the device from Intune management and retires it |
| A Windows corporate device is being reassigned internally | Autopilot Reset | Removes personal files, apps, and settings while returning the device to a business-ready, enrolled state |
| Help desk needs logs without asking the user to gather them | Collect diagnostics | Uploads troubleshooting files to Intune for investigation |
| A user needs guided support | New remote assistance session | Starts Remote Help or a configured partner tool such as TeamViewer |
Retire, wipe, delete, and reset
These four are easy to confuse, and the exam wording usually tells you the answer. Retire is the least destructive. Use it when the device is personal or when you only need to remove organization data and management while preserving the user's personal apps and data. Wipe is destructive: it restores factory settings and is for lost, stolen, reassigned, or compromised corporate devices where a full reset is acceptable. Wipe has options on Windows such as retaining enrollment state for a fresh provisioning pass. Delete removes the Intune device record and management relationship, and it also retires the device.
Autopilot Reset is specific to Windows: it returns the device to a business-ready state while keeping it enrolled and Microsoft Entra joined for reuse, which is why it is the best answer for internal device reassignment rather than a full Wipe.
A useful decision sequence is:
- Is the device personal and the user is leaving? Use Retire.
- Is the device corporate and data must be removed because it is lost or compromised? Use Wipe.
- Is the Windows device staying in the organization for a new user? Consider Autopilot Reset.
- Is the issue only delayed policy or app state? Use Sync first.
- Is evidence needed before changing the device? Use Collect diagnostics before destructive actions where possible.
Bulk actions
Bulk actions reduce repetitive work across fleets, classrooms, kiosks, and frontline devices. Intune supports bulk device actions for up to 100 devices at a time, and you select the OS, the management state, and then the action. The supported bulk actions differ by platform. Windows bulk actions include choices such as Autopilot reset, Collect diagnostics, Delete, Rename, Restart, Retire, Sync, and Wipe. Apple, Android, macOS, and ChromeOS each have their own supported lists, so an action available for Windows may simply not exist for another platform.
Bulk actions are not the same as policy assignment. A policy keeps applying over time; a bulk action runs a command once. Use policy for ongoing configuration, update rings, compliance, and app deployment. Use a bulk action for a point-in-time operation such as wiping a set of student devices at the end of a school year or syncing a group of kiosks after a profile change.
One operational warning is especially testable: Retire, Wipe, and Delete take precedence over other pending actions. If a device has several queued commands, the destructive lifecycle action wins and the system ignores the other pending actions. This is why high-impact actions should be governed by a clear operational process, correct RBAC scoping, and documentation. On the exam, when a stem describes destructive and non-destructive commands queued together, expect the destructive lifecycle action to be the one that executes.
Other operationally important actions
Beyond the lifecycle commands, several targeted remote actions appear in MD-102 scenarios. Fresh Start (Windows) removes installed apps while keeping user data and reinstalls the latest Windows version, which is useful for clearing OEM bloat or a broken app state without a full Wipe. Remote lock locks a lost device, and on supported platforms a passcode reset or temporary passcode helps when a user is locked out. Locate device can show the last known location of a supervised, lost-mode-eligible device. Rename device updates the Intune display name, and on Windows it can rename the device object where supported.
Quick scan / Full scan and Update Windows Defender security intelligence are security-focused actions covered in the troubleshooting section.
When reading a scenario, map the verb in the requirement to the action: "the device is lost but might be recovered" suggests Lock or Locate before Wipe; "the app environment is corrupted but keep the user's files" suggests Fresh Start; "the user forgot their passcode" suggests a passcode reset rather than a Wipe. Reaching for a destructive action when a targeted one solves the problem is a classic wrong answer.
Where remote actions fit in troubleshooting
Remote actions are most powerful as the first, low-impact step in an investigation. If a policy or app is not applying, Sync is faster and safer than re-creating the assignment. If you need evidence, Collect diagnostics or a device query gathers data without disturbing the user. Only after these confirm a genuine device-level problem should you escalate to Restart, Fresh Start, or a lifecycle action. This least-disruptive-first ordering is exactly the operational judgment the exam rewards: the best answer is rarely the most destructive option that technically resolves the symptom.
You just assigned a configuration profile and need a managed Windows device to contact Intune immediately instead of waiting for its normal check-in. Which remote action should you try first?
A personally owned enrolled phone belongs to an employee who is leaving. The company needs to remove organization data but preserve personal photos and apps. Which action best fits?
Which statements about Intune bulk and remote actions are correct?
Select all that apply