📱 Recipe · Intune & Device Management
Remotely Reboot an Intune-Managed Device via Microsoft Graph
Trigger an immediate reboot on a stuck or unresponsive Intune-managed Windows device and verify check-in
Complexity
Beginner
Impact
device-management + help-desk + user-support + intune + windows
Context
Why This Matters
When to use this recipe
End users occasionally report that their Windows device is unresponsive after a feature update, a policy deployment, or a long-running install. Rather than walking the user through a hard power-off (which risks data loss and filesystem corruption), an IT admin can issue a graceful remote reboot through Intune. The device receives the command on its next Intune check-in (or immediately if it is online), closes sessions cleanly, and restarts.
Typical triggers:
- Device is stuck on a spinning wheel, login screen, or post-update screen
- Applications fail to launch and a restart would clear the state
- A required policy or configuration needs to take effect after reboot
- The user is remote and cannot reach the power button (e.g., a remote VM)
This recipe covers locating the user's device, issuing the rebootNow action via Microsoft Graph, and verifying that the device checked back in afterward.
Expected Outcomes
After completing this recipe you will have:
- Identified the correct Intune-managed device for the target user
- Triggered a remote reboot using the Microsoft Graph
rebootNowaction - Confirmed Intune accepted the reboot command (HTTP 204 response)
- Verified the device checked back in by inspecting the updated
lastSyncDateTime - A repeatable PowerShell workflow for future reboot requests
Risks & Considerations
Warnings and gotchas
- Unsaved work will be lost.
rebootNowdoes not prompt the end user — it forces a restart. Where possible, notify the user first (Teams message, email) and give them a few minutes to save. - Endpoint naming matters. Use
/v1.0/deviceManagement/managedDevices/{id}/rebootNow. The beta graph does not expose a/rebootsegment and will returnHTTP 400 - Resource not found for the segment 'reboot'. - The command is queued, not synchronous. A 204 response means Intune accepted the request. The device must be online (or check in) before it actually reboots. For offline devices, the command can sit for hours.
- lastSyncDateTime lag. Immediately after issuing the reboot, the sync timestamp will still show the pre-reboot time. Wait 5–15 minutes and re-check before concluding the device is unresponsive.
- Platform support.
rebootNowis supported on Windows 10/11 and macOS. It is not supported on iOS/iPadOS or Android personal profiles. - Privileged operation. The reboot action requires the
DeviceManagementManagedDevices.PrivilegedOperations.Allscope — treat it as a change action and log it in your change record. - Do NOT loop reboots. If the first reboot doesn't resolve the issue, investigate (event logs, Intune diagnostics) before issuing another. Repeated forced reboots can interrupt update sequencing and leave the device in a worse state.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| DeviceManagementManagedDevices.Read.All | Read the list of managed devices to locate the target device by user or device name |
| DeviceManagementManagedDevices.PrivilegedOperations.All | Required to invoke the rebootNow action against a managed device |
| User.Read.All | Resolve the user's UPN and object ID when searching for their devices |
| Intune Administrator or Help Desk Operator role | Directory role granting permission to perform device actions in Intune |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
For End Users
How an employee would ask Dex for help
Reboot a device from the Microsoft Intune admin center
Open Microsoft Intune admin center and sign in with an account that holds the Intune Administrator or Help Desk Operator role.
Navigate to:
Devices › All devices
In the filter bar, search for the device name or the user's UPN (e.g.,
matan.sheinberg@contoso.com). Confirm the row matches the user's assigned device — check Primary user, OS, and Last check-in.Click the device name to open its overview blade.
On the command bar at the top, click … More (if needed) and select Restart.
Read the confirmation dialog carefully. It warns that the user has 5 minutes to save work before Windows restarts. Click Yes to confirm.
A notification banner will confirm the action was sent. The device overview will show Restart - Pending under Device actions status.
Wait 5–15 minutes, then refresh the device blade. Verify:
- Last check-in has updated to a recent timestamp
- Device actions status shows Restart - Complete
If the action stays in Pending for more than 30 minutes, the device is likely offline. Contact the user or attempt a manual power cycle.
Reboot a device via Microsoft Graph
Step 1 — Resolve the user (optional)
If you only have the user's name or UPN, confirm the account exists:
GET https://graph.microsoft.com/v1.0/users/{userPrincipalName}?$select=id,displayName,userPrincipalNameExample response:
{
"id": "2cdb295b-4b23-4fc3-bd48-5331d1693a7e",
"displayName": "Matan Sheinberg",
"userPrincipalName": "matan.sheinberg@contoso.com"
}Step 2 — Find the managed device
GET https://graph.microsoft.com/beta/deviceManagement/managedDevices?$filter=userPrincipalName eq '{upn}'&$select=id,deviceName,operatingSystem,model,lastSyncDateTime,complianceStatePick the device ID that matches the user's affected machine. Example:
{
"id": "cfd782ad-9556-4cd5-b64b-c06e70b8d706",
"deviceName": "DESKTOP-O7KP0T2",
"operatingSystem": "Windows",
"lastSyncDateTime": "2026-02-02T14:45:58Z"
}Step 3 — Trigger the reboot
Important: use the v1.0 endpoint with the action name rebootNow. The beta /reboot segment is not valid and returns HTTP 400.
POST https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{deviceId}/rebootNow
Content-Length: 0Successful response:
HTTP/1.1 204 No ContentA 204 means Intune has queued the command. If the device is online it will reboot within 1–2 minutes; otherwise the command waits for the next check-in.
Step 4 — Verify check-in
After 5–15 minutes, poll the device to see if lastSyncDateTime advanced:
GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{deviceId}?$select=id,deviceName,lastSyncDateTime,managementStateIf the timestamp is within the last few minutes and managementState is managed, the device rebooted and checked in successfully.
Common errors
| Status | Meaning | Fix |
|---|---|---|
| 400 — Resource not found for the segment 'reboot' | Wrong action name | Use rebootNow, not reboot |
| 403 — Forbidden | Missing scope/role | Grant DeviceManagementManagedDevices.PrivilegedOperations.All |
| 404 — Not Found | Wrong device ID | Re-query managedDevices |
Reboot a device with PowerShell and Microsoft Graph
The Microsoft Graph PowerShell SDK wraps the same REST endpoints and handles authentication for you.
1. Install and connect
# One-time install
Install-Module Microsoft.Graph.DeviceManagement.Actions -Scope CurrentUser
Install-Module Microsoft.Graph.DeviceManagement -Scope CurrentUser
# Connect with the required scopes
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All","DeviceManagementManagedDevices.PrivilegedOperations.All","User.Read.All"2. Find the device
$upn = "matan.sheinberg@contoso.com"
$device = Get-MgDeviceManagementManagedDevice -Filter "userPrincipalName eq '$upn'" |
Select-Object -First 1 Id, DeviceName, OperatingSystem, LastSyncDateTime
$device3. Issue the reboot
Invoke-MgRebootNowManagedDevice -ManagedDeviceId $device.IdNo output on success (HTTP 204). An exception indicates a permission or ID problem.
4. Verify check-in
Start-Sleep -Seconds 300
Get-MgDeviceManagementManagedDevice -ManagedDeviceId $device.Id |
Select-Object DeviceName, LastSyncDateTime, ManagementStateCompare the new LastSyncDateTime against the value captured before the reboot. If it advanced, the device rebooted and checked in.
Next steps