Use remote actions to manage devices using Microsoft Intune
In Microsoft Intune, you can remotely run and execute commands on devices.
For example:
- If a device is lost or stolen, you can reset or wipe the device.
- Your help desk can reset a password, lock the device, or collect diagnostic data.
- You can synchronize devices that haven't checked-in to Intune for a while.
- Do a quick scan or full scan of a device using Microsoft Defender Antivirus.
- And more
Use remote device actions to help you manage your devices remotely, without having to physically touch the device. This feature is available for devices that are enrolled in Intune and devices that are enrolled in other mobile device management (MDM) services.
This feature applies to:
- Android
- iOS/iPadOS
- macOS
- Windows
This article shows you how to see the available remote actions, and lists some of the common remote actions you can run on your devices.
Prerequisites
To run remote actions, at a minimum, sign into the Intune admin center with an account that has the Help Desk Operator role. For more information on the different roles, go to Role-based access control (RBAC) with Microsoft Intune.
To receive the remote action, the device must be connected to the internet and powered on.
Get to your devices
Sign in to the Microsoft Intune admin center.
Select Devices. This view shows detailed information about the individual devices, and what you can do with them, including:
Overview: Shows a visual snapshot of the enrolled devices, how many devices are using the different platforms, and more.
All devices: Shows a list of the enrolled devices you manage.
Use the Export feature to create a `.zip`` list of all the devices, in increments of 10,000 (Internet Explorer) or 30,000 (Microsoft Edge, Chrome).
Select any device to view more details about that device, like hardware details, installed apps, policies, which remote actions are available for the device, and more.
By platform: View lists of devices by the specific platform.
Enrollment: Opens the enrollment page and lists the different enrollment options for each platform.
Configuration, Compliance, Conditional Access: These options let you create new policies and view & update existing policies.
Device cleanup rules: Automatically removes inactive devices from Intune. For more information, go to Automatically delete devices with cleanup rules.
Device categories: Create device categories to help organize devices and build dynamic device groups.
Help and Support provides a shortcut on troubleshooting tips, requesting support, or checking the status of Intune.
Available remote actions
The available device actions depend on the device platform and the device configuration. Not all actions are available for all devices.
For a complete list of what can be done on your devices, in the Intune admin center, select Devices > All devices, and select a specific device. The available device actions are shown at the top.
The following list includes some common device actions:
| Action | Description | Supported OS |
|---|---|---|
| Autopilot reset | Restores a device to its original settings and removes personal files, apps, and settings. | Windows |
| BitLocker key rotation | Changes the BitLocker recovery key for a device and uploads the new key to Intune. | Windows |
| Collect diagnostics | Collects diagnostic logs from a device and uploads the logs to Intune. | Windows 10 |
| Delete | Removes a device from Intune management, any company data is removed, and the device is retired. | - Android - iOS/iPadOS - macOS - Windows |
| Disable Activation Lock | Removes the Activation Lock from a device that is enrolled with a device enrollment manager (DEM) account. | - iOS/iPadOS - macOS |
| Fresh Start | Reinstalls the latest version of Windows on a device and removes apps that the manufacturer installed. | Windows |
| Full Scan | Initiates a full scan of the device by Microsoft Defender Antivirus. | Windows |
| Locate device | Shows the approximate location of a device on a map. | - Android - iOS/iPadOS - Windows |
| Lost mode | Locks a device with a custom message and disables sound and vibration. | iOS/iPadOS |
| Pause Config Refresh | Pause ConfigRefresh to run remediation on a device for troubleshooting or maintenance or to make changes. | (Windows 11 only) |
| Quick Scan | Initiates a quick scan of the device by Microsoft Defender Antivirus. | Windows |
| Remote control with Team Viewer | Allows you to remotely control a device using TeamViewer. | - Android - iOS/iPadOS - macOS - Windows |
| Remote lock | Locks a device and resets its password. | - Android - iOS/iPadOS - macOS |
| Rename device | Changes the device name in Intune. | - Android - iOS/iPadOS - macOS - Windows |
| Reset passcode | Resets the device passcode. | - Android - iOS/iPadOS |
| Restart | Restarts a device. | - Android - iOS/iPadOS - macOS - Windows |
| Retire | Removes company data and settings from a device, and leaves personal data intact. | - Android - iOS/iPadOS - macOS - Windows |
| Rotate Local admin password | Changes the local administrator password for a device and stores the password in Intune. | Windows |
| Send custom notification | Sends a custom notification message to a device that can be viewed in the Company Portal app. | - Android - iOS/iPadOS |
| Synchronize device | Syncs a device with Intune to apply the latest policies and configurations. | - Android - iOS/iPadOS - macOS - Windows |
| Update cellular data plan | Updates the cellular data plan settings for a device that uses an eSIM profile. | iOS/iPadOS |
| Update Windows Defender Security Intelligence | Updates the security intelligence files for Microsoft Defender Antivirus. | Windows |
| Windows 10 PIN reset | Resets the PIN of a device that uses Microsoft Entra authentication. | Windows 10 Mobile |
| Wipe | This action restores a device to its factory settings and removes all data and settings. | - Android - iOS/iPadOS - macOS - Windows |
Note
The Retire, Wipe, and Delete actions take precendence over all other actions. A device with multiple pending actions only carry out a Retire, Wipe, or Delete. All other pending actions are ignored.
You can also:
- See a full device inventory of all the devices (Devices > All devices).
- Run bulk device actions on multiple devices at the same time (Devices > All devices > Bulk Device Actions).