Skip to main content

048: Remote actions

Implementation Effort: Low to Medium
User Impact: Medium

Overview​

In app protection scenarios, the most important "remote action" is often selective wipe of organizational data from protected apps. This is different from wiping or retiring an enrolled device: selective wipe removes the work account data managed by the app protection boundary and is particularly useful for BYOD and contractor scenarios.

Zero Trust assumes a user, device, or session can become untrusted. Selective wipe gives administrators a way to remove work data quickly without erasing the user’s personal device.

Implementation Guidance​

  1. Use selective wipe for scenarios such as employee offboarding, lost BYOD device, contractor access removal, or repeated violation of app protection requirements.
  2. Make sure support teams understand the difference between:
    • Selective wipe of protected app data
    • Retire of an enrolled device
    • Full wipe of an enrolled device
  3. Test selective wipe with the protected apps actually deployed in your environment.
  4. Communicate clearly that the wipe affects work data in managed apps, not the user’s personal content.
  5. Where appropriate, combine selective wipe with Conditional Launch actions or account-disable processes.
  6. Audit who can initiate the action and when it was used.

Selective wipe is one of the clearest examples of how app protection supports Zero Trust on personal devices.

Reference​