Intune gives you five different ways to remove or reset a device, and the names don’t make the behavior obvious. Choosing the wrong one is usually recoverable – but occasionally it isn’t, and understanding what each action actually does before you click it is the kind of thing that matters at 4pm on a Friday when someone’s laptop has been stolen.
Here’s what each action does, what it doesn’t do, and when to use it.
Retire
Retire removes Intune’s management footprint from the device – enrolled email profiles, certificates, Wi-Fi and VPN profiles, managed app data, and the MDM enrollment itself. It does not wipe the device. Personal data stays. On Windows, Win32 apps installed by Intune also stay, which is a commonly missed detail. The device is unenrolled from management, but it isn’t cleaned.
Retire is asynchronous – it queues the retire command and the device acts on it the next time it checks in. If the device is offline or never checks in again, the command never executes. This is the gap in Retire that makes it unsuitable for lost or stolen device scenarios – you can’t be sure the command will land.
Use Retire for BYOD device offboarding – when an employee leaves and you want to remove corporate data from their personal device without touching their personal content. It respects the personal/corporate boundary that MAM is designed around. For corporate-owned devices, Wipe is almost always the right choice instead.
Wipe
Wipe is a factory reset. It restores the device to out-of-box state, removes all data, all apps, all settings, and unenrolls from Intune. This is the action for lost or stolen corporate devices, for decommissioning, and for clearing a device before reassignment where you need to be certain no data from the previous user remains.
Wipe has two modifiers worth understanding. “Retain enrollment state and user account” keeps the Entra ID join and Intune enrollment intact through the wipe – the device returns to a managed state without needing to go through enrollment again. This is useful when wiping a device for reassignment within the organization. Without this option, the device returns to a clean unmanaged state and will need to re-enroll, which for Autopilot devices means the Autopilot profile will fire during OOBE. The second modifier – “Wipe device and continue to wipe even if device loses power” – ensures the wipe completes even if the battery dies during the process, which matters for seized or unresponsive devices where you can’t guarantee power continuity.
Wipe is the right action for lost or stolen corporate devices. Retire is not – Retire is asynchronous and leaves data in place. If the device is gone and you want it clean, use Wipe.
Delete
Delete removes the device record from the Intune portal immediately. It also sends a Retire command to the device, but that command is asynchronous – if the device never checks in, the retire never happens. Delete does not affect the physical device if it’s offline. It does not guarantee unenrollment. What it guarantees is that the device disappears from your device list right now.
Delete is for administrative cleanup – removing stale records, duplicate entries, devices that have already been wiped or decommissioned outside of Intune, devices that were never successfully enrolled and left a ghost record. It is not a security action. If you’re trying to ensure a device is clean and unenrolled, use Wipe before Delete, not instead of it.
One Autopilot-specific behaviour worth knowing: if a device has a Windows Autopilot Zero Touch ID (ZTDID) assigned, it cannot be removed from Entra ID until it’s first removed from Intune. If you try to delete the Entra ID device object directly for an Autopilot-registered device, it won’t work. Remove it in Intune first, then clean up Entra ID.
Fresh Start
Fresh Start reinstalls Windows from a clean image, removing OEM-preloaded applications and bloatware that come bundled with devices purchased through retail channels. The device stays Entra ID joined and Intune enrolled through the process – unlike Wipe without the retain enrollment option, Fresh Start doesn’t break the management relationship.
Fresh Start has an option to retain user data. If you retain user data, the contents of the user’s home folder stay. If you don’t, the device returns to a clean completed OOBE state. Either way, the device remains joined and enrolled.
The primary use case for Fresh Start is devices that arrived with significant OEM bloatware that you want to remove without re-provisioning from scratch. For devices enrolled through Autopilot or with a clean Windows image, Fresh Start offers less value than Autopilot Reset for day-to-day device handover scenarios. It’s most useful when you have retail-purchased hardware and want a clean OS baseline without going through a full wipe and re-enrollment cycle.
Autopilot Reset
Autopilot Reset removes the user profile, user files, user-installed apps, and user settings from the device. It keeps the Entra ID join, the Intune enrollment, regional and language settings, and Wi-Fi configuration. The device doesn’t go through OOBE or the full Autopilot provisioning flow again – it comes up directly at the Windows login screen, ready for a new user to sign in. Policies and applications re-apply from Intune as the new user logs in.
Autopilot Reset is the right action for device reassignment within the organization. An employee leaves, you run Autopilot Reset, the next employee gets a device that’s enrolled, configured, and ready. No IT touch required. No re-provisioning. No waiting for Autopilot to run again.
Autopilot Reset does not format the drive. The previous user’s data remains in a Windows.old folder that persists after the reset. For most internal device reassignment scenarios this is acceptable. For scenarios where complete data removal is required, use Wipe instead.
That Windows.old caveat matters for security-conscious environments. Autopilot Reset is fast and operationally clean, but it is not a secure erase. If the previous user had sensitive data on the device and complete removal is required – for compliance, for role change to a more sensitive position, for devices going outside the organization – use Wipe, not Autopilot Reset.
Hybrid Entra Joined Devices
Hybrid joined devices – those that are both domain-joined on-premises and registered in Entra ID – behave differently under several of these actions, and the differences matter.
Autopilot Reset is not supported on hybrid joined devices. If you try to run it, it will fail. For hybrid devices that need to be reassigned, your options are Wipe or a manual re-provision process.
Retire on a hybrid device removes the Intune management footprint and the Entra ID device record, but it does not touch the on-premises Active Directory computer object. After Retire, the device is still domain-joined – just no longer Intune managed. The on-prem computer object remains and needs to be cleaned up manually in AD if you’re decommissioning the device.
Wipe on a hybrid device resets the device and removes the Entra ID record, but the on-premises AD computer object also remains. More importantly – because Entra Connect syncs from on-premises AD to Entra ID, the Entra ID device object will be recreated by the next sync cycle unless you also disable or delete the computer object in on-premises AD first. Wipe without on-prem AD cleanup produces a stale Entra ID record that keeps coming back.
Delete on hybrid devices follows the same pattern – the Microsoft guidance is to manage stale hybrid devices by disabling or deleting the computer object in on-premises AD and letting Entra Connect synchronize the change to Entra ID, rather than deleting from the Entra ID side directly.
Wipe reliability on hybrid devices is also lower than on cloud-native devices. In practice, a wipe command can be delivered, Intune removes the device record from the portal – confirming delivery – and the physical device simply reboots back into Windows unchanged. This happens because the reset process on a hybrid device can fail silently: Windows initiates the reset, encounters a problem – domain trust issues, Group Policy restrictions on the reset path, ConfigMgr client interference in co-managed scenarios – and aborts back to a normal reboot instead of completing the factory reset. From Intune’s side the command looks delivered. The device is untouched.
A wipe confirmation from Intune – device removed from portal – does not confirm the physical device was wiped on a hybrid device. You need eyes on the device or a re-enrollment signal to know for certain.
WinRE – the Windows Recovery Environment – needs to be functional for reset operations to complete. You can verify it on a device by running reagentc /info from an elevated command prompt. The output should show Windows RE status: Enabled and a valid path to the recovery image. If it shows disabled, reagentc /enable re-enables it. Even with WinRE enabled, hybrid devices can still fail to wipe for the reasons above – WinRE being enabled is a prerequisite, not a guarantee. For environments where wipe reliability matters, building a Proactive Remediation that checks WinRE status across your fleet before you ever need to use it is worth the effort.
Every action on a hybrid device has an on-premises AD component that Intune can’t reach. Always account for the on-prem computer object cleanup – it won’t happen automatically.
Quick Reference
Device lost or stolen: Wipe – factory reset, all data removed, command persists even if device loses power.
Employee leaving, personal device: Retire – removes corporate footprint, personal data stays, respects BYOD boundary.
Employee leaving, corporate device for reassignment: Autopilot Reset – removes user profile, keeps enrollment and configuration, device ready for next user.
Employee leaving, corporate device, complete data removal required: Wipe – full factory reset, drive cleaned, not just user profile removed.
Stale device record cleanup, device already decommissioned: Delete – removes Intune record, administrative cleanup only.
Retail-purchased device with OEM bloatware, need clean Windows image: Fresh Start – clean OS reinstall, enrollment preserved, bloatware removed.
