📱 Recipe · Intune & Device Management
Remotely Wipe an Intune-Managed Device via Microsoft Graph
Issue a factory-reset wipe command to a lost, stolen, or decommissioned Windows/iOS/Android device enrolled in Intune
Complexity
Intermediate
Impact
destructive + privileged + device-lifecycle + security-incident
Context
Why This Matters
A remote wipe is one of the most powerful — and destructive — actions available to an Intune administrator. It returns a managed device to its factory default state, removing the OS configuration, user data, installed apps, and Intune enrollment. Use this recipe when:
- A device has been reported lost or stolen and contains corporate data.
- An employee has left the organization and their company-owned device must be reset before reassignment.
- A device is being decommissioned or recycled and you need assurance that no residual data remains.
- A device has been compromised (malware, unauthorized access) and you need to return it to a known-good state.
For BYOD scenarios where you only want to remove corporate data and leave personal content intact, use a retire action instead of wipe.
Expected Outcomes
After completing this recipe you will have:
- Located a specific managed device by name, serial number, or primary user.
- Verified device ownership and the primary user before taking a destructive action.
- Issued a remote wipe command via Microsoft Graph, the Intune portal, or PowerShell.
- Confirmed the command was accepted (HTTP 204 No Content) and understand when it will execute on the endpoint.
The device will begin the wipe on its next Intune check-in (typically within 15 minutes when online). Progress can be monitored under .
Risks & Considerations
⚠️ Destructive and largely irreversible
- Data loss is permanent. Once the device checks in and starts the wipe, all local data, user profiles, and applications are destroyed. There is no undo.
- Always verify the target device. Device names can be similar (e.g.
DESKTOP-GORGEOUS-OPTIMAL458vsDESKTOP-GORGEOUS-OPTIMAL485). Confirm the device ID and primary user before sending the command. - Do not wipe BYOD devices. Wiping a personally owned device destroys the user's personal photos, apps, and data and can create legal/HR exposure. Use retire instead.
- keepUserData vs keepEnrollmentData flags — choose deliberately. Setting both to
falseperforms a full factory reset. SettingkeepEnrollmentData: truepreserves Autopilot enrollment so the device can re-provision automatically. - BitLocker / FileVault recovery keys should be backed up before wipe if there is any chance the device may go offline mid-wipe and need recovery.
- Approval and audit. Require ticket or manager approval before wiping company assets. All wipe actions are logged in the Intune audit log and Entra sign-in logs — review them for compliance.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| DeviceManagementManagedDevices.PrivilegedOperations.All | Required to send the wipe, retire, reset, or remote lock action to a managed device. |
| DeviceManagementManagedDevices.Read.All | Required to look up the device by name and read device properties before wiping. |
| Intune Administrator or Global Administrator role | Role-based access to execute privileged device actions in Intune. |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
Send a remote wipe to the Intune-managed device named {device_name}. Verify the device's primary user and ownership before executing, then confirm the wipe command was accepted.
For End Users
How an employee would ask Dex for help
My work laptop was stolen — please wipe it so no one can access my company files.
Wipe a device from the Intune admin center
- Sign in to the Microsoft Intune admin center at
https://intune.microsoft.comas an Intune Administrator or Global Administrator. - Navigate to .
- In the filter/search bar, type the device name (e.g.
DESKTOP-GORGEOUS-OPTIMAL458). Click the device to open its overview blade. - Verify the device details on the Overview page — confirm the Primary user, Serial number, Ownership (Corporate vs Personal), and Last check-in.
- In the command bar at the top of the device blade, click Wipe.
- In the Wipe flyout, choose your options:
- Wipe device, even if it is not connected to power or the internet — leave unchecked unless you explicitly want the wipe to start on a low-battery device.
- Retain enrollment state and associated user account — check this if the device should re-enroll automatically via Autopilot after the reset.
- Click Wipe to confirm. You will be prompted to re-authenticate for this privileged action.
- Monitor progress under . Status will transition from Pending → Active → Complete.
Wipe a device using Microsoft Graph
The wipe action is a two-call flow: first locate the device to retrieve its Intune object ID, then POST to the /wipe action endpoint.
Step 1 — Look up the device by name
GET https://graph.microsoft.com/beta/deviceManagement/managedDevices?$filter=deviceName eq 'DESKTOP-GORGEOUS-OPTIMAL458'&$select=id,deviceName,userPrincipalName,operatingSystem,complianceState,serialNumberExample response (abbreviated):
{
"value": [
{
"id": "cea20c5f-54ee-44e6-9730-604c69a828f1",
"deviceName": "DESKTOP-GORGEOUS-OPTIMAL458",
"userPrincipalName": "AlexW@contoso.com",
"operatingSystem": "Windows",
"complianceState": "compliant",
"serialNumber": "SN2766LUHTM"
}
]
}Step 2 — Send the wipe action
POST https://graph.microsoft.com/beta/deviceManagement/managedDevices/{managedDeviceId}/wipe
Content-Type: application/json
{
"keepEnrollmentData": false,
"keepUserData": false,
"useProtectedWipe": false,
"macOsUnlockCode": null
}A successful wipe returns 204 No Content. The command is queued and will execute when the device next contacts Intune.
Payload parameters
keepEnrollmentData—trueretains Intune/Autopilot enrollment metadata so the device can re-provision without manual enrollment.keepUserData—truekeeps user accounts and data (Windows only; treated as a reset rather than full wipe).useProtectedWipe—trueforces a cryptographic wipe on supported hardware.macOsUnlockCode— 6-digit PIN displayed on a wiped Mac for recovery (only relevant for macOS).
Check action status
GET https://graph.microsoft.com/beta/deviceManagement/managedDevices/{managedDeviceId}?$select=deviceActionResultsWipe a device using PowerShell and Microsoft Graph
This example uses the Microsoft.Graph PowerShell SDK. You can also call Graph directly with Invoke-MgGraphRequest, which the downloadable script below demonstrates.
1. Install and connect
# Install once
Install-Module Microsoft.Graph -Scope CurrentUser
# Connect with the required delegated scopes
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.PrivilegedOperations.All","DeviceManagementManagedDevices.Read.All"2. Find the device
$deviceName = "DESKTOP-GORGEOUS-OPTIMAL458"
$device = Get-MgBetaDeviceManagementManagedDevice -Filter "deviceName eq '$deviceName'"
if (-not $device) { throw "Device '$deviceName' not found." }
$device | Format-List deviceName,id,userPrincipalName,serialNumber,complianceState3. Confirm and wipe
$confirm = Read-Host "Type WIPE to confirm wipe of $($device.deviceName)"
if ($confirm -ne "WIPE") { throw "Aborted." }
$body = @{
keepEnrollmentData = $false
keepUserData = $false
}
Invoke-MgGraphRequest -Method POST `
-Uri "https://graph.microsoft.com/beta/deviceManagement/managedDevices/$($device.id)/wipe" `
-Body ($body | ConvertTo-Json)
Write-Host "Wipe command sent to $($device.deviceName)" -ForegroundColor GreenA 204 response means the command was accepted. The device performs the wipe on its next Intune check-in.
Next steps