Skip to main content

073: Remote actions

Implementation Effort: Low to Medium

User Impact: Medium to High

Overview​

Remote actions in Microsoft Intune let administrators respond quickly to lost devices, support incidents, and offboarding events without waiting for the device to be physically returned. Common actions include retire, wipe, sync, restart where supported, passcode-related actions on supported platforms, and Lost Mode on supervised Apple devices.

In a Zero Trust program, remote actions are part of containment and lifecycle management: they help remove trust when a device should no longer access organizational resources.

Implementation Guidance​

  1. Define which teams are allowed to run which remote actions. Wipe and retire should usually be restricted more tightly than sync or restart.
  2. Document the operational purpose of each action: retire removes organizational data and management, wipe resets the device, and platform-specific actions such as Lost Mode may be appropriate for missing corporate Apple devices.
  3. Train support staff not to use destructive actions when a less disruptive action would solve the issue.
  4. Verify platform prerequisites. Not every action is supported on every Apple enrollment type, device state, or supervision model.
  5. Pair remote actions with user communication and incident logging so high-impact actions are traceable and supportable.
  6. Test actions in a lab or pilot population before assuming they behave the same across every device type.

Reference​