028: Remote actions

Implementation Effort: Medium
User Impact: Medium to High depending on action

Overview

Remote actions in Microsoft Intune let administrators respond quickly when a device is lost, noncompliant, transferred, or needs troubleshooting. Examples include sync, restart, rename, retire, wipe, passcode reset, key rotation, and collecting diagnostics, depending on platform and enrollment method.

For Zero Trust, remote actions support the "assume breach" principle by enabling containment without waiting for physical access to the device.

Implementation Guidance

1. Classify remote actions into operational categories:
   • Low risk: sync, restart, collect diagnostics
   • Medium risk: retire, remote lock, key rotation
   • High risk: wipe, passcode reset, destructive recovery actions
2. Restrict who can perform higher-risk actions through Intune RBAC and approval processes.
3. Document action prerequisites by platform. Not every action is available for Windows, macOS, Android, iOS/iPadOS, and shared devices in the same way.
4. Define which actions are used for which event types, such as lost device, terminated employee, malware response, or device reassignment.
5. Train help desk staff on user communication before running disruptive actions.
6. Test remote actions on pilot devices so you understand timing, user prompts, and post-action behavior.
7. Review audit logs regularly to confirm that destructive actions are justified and properly authorized.

Remote actions are most effective when they are part of a documented runbook rather than an improvised response during an incident.

Reference

• Device Actions - Wipe, Lock, Locate, and More - Microsoft Intune — Summarizes the remote device actions Intune administrators can run.
• Wipe devices with Microsoft Intune - Microsoft Intune — Explains how to wipe enrolled devices when retiring or resetting them.
• Device Action: Collect Diagnostics - Microsoft Intune — Covers collecting remote diagnostic logs from managed devices through Intune.