Understanding Device Actions in Microsoft Intune: What They Do and When to Use Them

Introduction

Microsoft Intune allows administrators to manage and secure devices across different platforms, including Windows, macOS, iOS, Android and Linux. The available management actions can vary depending on the device platform and configuration.

Once a device is enrolled in Intune, administrators can do more than simply monitor its status. They can perform remote actions to manage devices, troubleshoot issues and maintain organisational security.

For instance, an employee may need a laptop restarted, a device may require a security scan, or company data may need to be removed when a device is reassigned.

This guide focuses specifically on Windows devices and explores where to find their available actions, what they do and when administrators might use them through the Microsoft Intune admin center.

What Are Device Actions in Microsoft Intune?

Device actions are remote management tasks that administrators can perform on devices enrolled in Microsoft Intune. They help IT teams manage devices without always needing physical access to them.

Administrators can use these actions for different day-to-day activities, such as:

• Troubleshooting: Restart a device or request it to sync with Intune.
• Security management: Run antivirus scans or rotate BitLocker recovery keys.
• Device maintenance: Perform management tasks to keep devices running as expected.
• Data protection: Remove organisational data or reset a device when it is being reassigned or retired.

For example, if an employee reports that their laptop is experiencing issues, an IT administrator can initiate a remote restart through Intune. Similarly, when a company laptop needs to be assigned to another employee, the administrator can choose an appropriate reset action to prepare it for reuse.

These actions give IT administrators a practical way to manage devices remotely and respond to different workplace requirements.

Where to Find Device Actions in Microsoft Intune

Once a device is enrolled in Intune, administrators can access its management options directly from the device overview page.

Follow these steps to locate them:

1. Sign in to Intune: Open the Microsoft Intune admin center and sign in using your administrator account.
2. Open Devices: Select Devices from the left navigation menu.
3. Select All devices: This displays the list of devices managed through Intune.
4. Choose a Windows device: Find the device you want to manage and select its name.
5. Open the device overview: The page displays information such as the device model, operating system and compliance status.

The image below shows the device overview page for a Windows device in the Microsoft Intune admin center, with the action toolbar at the top.

• Explore the available actions: Look at the toolbar at the top of the page. The actions are organised into different menus, including Remote actions, Secure and the three-dot (…) menu.

The image below shows the Remote actions menu opened from the toolbar.

Some actions, such as Sync, are available directly in the toolbar, while others are grouped under their respective menus. Select the relevant option to view or initiate an action.

Common Device Actions in Microsoft Intune

Microsoft Intune provides several actions that help administrators manage Windows devices remotely. These actions support everyday troubleshooting, security and device maintenance.

1. Main Toolbar Actions

Some actions are available directly from the device overview toolbar.

• Sync: Requests the device to check in with Intune. Useful when a newly assigned policy has not reached the device.
• Run remediation: Runs an available script to resolve a device issue, such as a configuration problem.
• Locate device: Shows the approximate device location, where supported. Useful when a company laptop is reported missing.

2. Remote Actions

The Remote actions menu provides additional management options.

• Restart: Restarts a device remotely, for example, when an employee reports performance issues.
• Pause config refresh: Temporarily pauses Configuration Refresh during troubleshooting or maintenance.

3. Security Actions

The Secure menu contains actions to help protect managed devices.

• Rotate local admin password: Changes the device’s local administrator password.
• Rotate BitLocker keys: Rotates the device’s BitLocker recovery key.
• Quick Scan: Quickly checks common areas for potential malware using Microsoft Defender Antivirus.
• Full Scan: Performs a more comprehensive scan of the device’s files and running programs.
• Update Defender intelligence: Updates the security intelligence used to identify potential threats.

The image below shows the Secure menu, including the Microsoft Defender scan options.

For example, if an employee reports suspicious activity, an administrator can initiate a Defender scan to check for malware.

4. Device Management Actions

The three-dot (…) menu provides options for resetting, reassigning or removing devices from organisational management.

• Fresh Start: Reinstalls Windows and removes manufacturer-installed applications, helping prepare a device with a cleaner installation.
• Autopilot Reset: Removes the previous user’s files, applications and settings while retaining the device’s Microsoft Entra ID identity and Intune enrolment. It also retains Wi-Fi connection details, allowing the device to reconnect to the organisational network after the reset. This is useful when preparing an eligible device for another employee.

The image below shows the three-dot menu, with Retire, Wipe, Fresh start and Autopilot reset listed next to Remove data and Delete.

Retire, Wipe and Delete serve different purposes:

Action	What it does	When to use it
Retire	Removes company data and management settings while preserving personal data where supported.	When removing organisational data without a factory reset.
Wipe	Resets the device and removes its data and settings, depending on the selected option.	When preparing a device for disposal or reassignment.
Delete	Removes the Intune device record and initiates retirement.	When removing an obsolete device record.

Understanding the Wipe Options

When selecting Wipe, administrators may see different reset options:

Option	What it does
Reset device and remove all data	Removes user data, applications and settings.
Reset device, but keep user data	Preserves user data, accounts and important settings while removing MDM policies and settings.
Securely erase device (high security)	Removes data and overwrites free space to make recovery harder. The wipe can continue if the device loses power, but a switched-off device must reconnect to receive the command.

The image below shows the Wipe window and its three reset options.

For example, if a laptop is being prepared for a new employee, the IT administrator needs to decide whether to remove the previous user’s files or keep them. The selected Wipe option determines what happens to the data during the reset.

Important Considerations When Using Device Actions

Before initiating a device action, keep a few things in mind:

• Internet connection: Make sure the device has an active internet connection so it can receive the command.
• Permissions: Ensure you have the required Intune permissions to perform the action.
• Compatibility: Available actions may vary depending on the device and its configuration.
• Data protection: Check the impact before performing actions such as Retire, Wipe or Fresh Start, as they may remove user data.
• Action status: After initiating an action, check its status in the Intune admin center to see whether it has completed.

Conclusion

Microsoft Intune device actions make it easier for IT administrators to manage devices remotely, troubleshoot issues and maintain organisational security. Understanding what each action does and when to use it helps administrators choose the right option and avoid unnecessary disruption.