What are Intune device actions

What are Intune device actions

Intune device actions are remote commands that administrators issue from the Microsoft Intune admin center to manage enrolled devices. They're basically your remote control for every laptop, phone, and tablet in your fleet. You can wipe a lost laptop, restart a frozen kiosk, or strip corporate data from a personal phone, all without physically touching the device.

You'll run into these most often during everyday IT scenarios. When someone leaves the company, you can retire their device to remove corporate data while leaving personal files alone. If a device goes missing, a full wipe restores it to factory defaults so nothing sensitive remains accessible.

For routine troubleshooting, a remote restart or sync can fix configuration drift without a support ticket. To run a device action, you need an appropriate Intune administrator role, and the device has to be enrolled in Intune. Some actions are platform-specific.

Fresh start only works on Windows devices, while Disable Activation Lock is iOS-only.

Available Intune device actions

Here's what you can do from the Intune admin center, along with platform support for each action.

Not every action is available on every device. The Intune admin center grays out unsupported actions based on the device's operating system and enrollment type.

How to run device actions from the Intune admin center

Running a single device action

1. Sign in to the Microsoft Intune admin center.
2. Go to Devices > All devices.
3. Select the device you want to manage.
4. On the device overview page, select the action you want from the toolbar (for example, Restart or Retire).
5. Confirm the action when prompted.

The action status appears on the device's overview page under Device action status. Most actions execute within minutes, though timing depends on the device's network connectivity and check-in schedule.

Running bulk device actions

Bulk device actions let you apply the same command to multiple devices in one operation instead of repeating the process device by device.

1. In the Intune admin center, go to Devices > All devices.
2. Select Bulk device actions.
3. Choose the operating system, then choose the device action.
4. Select the devices or upload a CSV file with device serial numbers.
5. Confirm and run the action.

Bulk actions support a subset of individual device actions, so not everything in the single-device table above is available in bulk mode. Bulk delete is one of the more common operations, particularly during hardware refresh cycles or when decommissioning a fleet of devices.

Wipe vs. retire vs. fresh start vs. delete

Picking the wrong action here can leave corporate data exposed or erase someone's personal files. These differences matter.

One thing that trips people up: the difference between wipe and Autopilot reset. Wipe strips everything and returns the device to a generic factory state. Autopilot reset also removes user data and apps, but it preserves the device's Autopilot enrollment profile and Microsoft Entra ID join status, so the device can be reprovisioned without manual setup.

For personal iPhones enrolled in Intune, a full wipe is technically possible, but retire is almost always the better call. Wipe erases the user's personal photos, messages, and apps along with corporate data. Retire removes only the managed layer and leaves everything else untouched.

Security risks of unaudited device actions

Device actions carry real security consequences when they go unmonitored. Every wipe, retire, and delete changes your environment's security posture, and an attacker or rogue admin can abuse these commands.

An unauthorized wipe can function as a denial-of-service attack against your own organization. Imagine a compromised admin account with Intune device management permissions wiping production devices across an entire department. Employees go offline, local data that hasn't been backed up is gone, and the damage scales fast with bulk actions.

Retire actions carry a different risk. If a device is retired instead of wiped, corporate data is supposed to be removed, but personal apps that cached corporate files may retain copies. An attacker who compromises a retired BYOD device could access residual corporate data that the retire action didn't fully clean.

Bulk delete actions create a cover-your-tracks problem. After exfiltrating data or planting persistence mechanisms, an attacker could bulk-delete device records from Intune to hide which devices were compromised. Without an audit trail that extends beyond the native 30-day retention window, forensic investigators lose visibility into which devices were removed and when.

ADAudit Plus tracks every Intune device action through the Intune Device Actions report, showing who initiated the action, which device was affected, and when it happened.

Limitations of native Intune audit logs

Intune logs every device action in its built-in audit log, but the native logging has gaps that make it insufficient for security monitoring and compliance in production environments.

30-day retention. Audit log retention in the Intune admin center tops out at 30 days. After that, device action records are permanently deleted. If an investigation starts more than a month after an incident, the relevant logs are gone.

No real-time alerting. You can't configure Intune to send an email or SMS notification the moment a bulk wipe or suspicious delete action occurs. Detection depends on someone manually reviewing the logs, and that rarely happens fast enough.

No correlation with on-premises AD. Say an attacker compromises an admin account, modifies AD group memberships to gain Intune permissions, and then wipes devices. You're now investigating two separate consoles with no connection between them. Good luck piecing that timeline together.

No scheduled report delivery. You can't configure Intune to email a daily summary of device actions to your security team or compliance auditors automatically.

No user behavior analytics. Intune can't tell you that a single admin account just issued ten times more wipe commands than usual, or that device deletions are happening at 2am on a Saturday. Pattern detection requires a tool that builds behavioral baselines.

Monitoring Intune device actions with ADAudit Plus

What ADAudit Plus monitors in Intune

ADAudit Plus includes pre-built reports under Cloud Directory > Intune Reports that cover the full range of Intune auditing scenarios. Each report captures who performed the action, which device or policy was affected, and the exact timestamp.

The available reports are:

• Intune Device Actions: All remote device actions (wipe, retire, restart, lock, sync, rename) with the initiating user, target device, action type, and result.
• Intune Device Enrollment: Enrollment events showing which devices were added to Intune management, by whom, and when.
• Intune Device Sync Action: Sync commands issued to devices, with user and device details.
• Delete Managed Device From Intune: Device removal events showing which records were deleted and who initiated the deletion.
• Restart Managed Device: Remote restart actions with full context.
• Device Compliance Policies: Changes to compliance policy configurations, including what was modified and the old and new values.
• Device Configuration Policies: Changes to device configuration profiles.
• Intune Application Activity: Application deployment and usage events across managed devices.

To access these reports, go to Cloud Directory > Intune Reports and select the report you need.

Native Intune audit logs vs. ADAudit Plus

FAQ