How to remote wipe a lost device with Intune

Remote wiping a lost device with Intune is one action in the portal, but the right action depends on ownership and enrolment: Wipe for a lost or stolen corporate device, Retire for a personal enrolled device, App selective wipe for a personal device managed only through app protection policies. Before any of them, revoke the user's sessions and confirm the disk was encrypted, because the wipe only happens when the device next comes online.

Device security design — encryption, compliance, app protection, and why a lost phone is mostly an identity problem — is in Microsoft 365 mobile device security. If the device was lost with a session that may have been used, treat the account per how to block a compromised account as well.

Prerequisites

Intune Administrator, or the Help Desk Operator Intune role (which includes remote wipe and retire) scoped to the right device groups.
The device identified in Intune: Devices → All devices, search by user or serial number. If it is not there, it is not enrolled and only an app selective wipe or account actions are possible.
For Windows: BitLocker recovery keys escrowed to Entra (Entra → Devices → the device → BitLocker keys). For macOS: FileVault key escrowed via the Intune FileVault policy. If keys are not escrowed, the wipe still works but you cannot prove the data was protected while offline.
Corporate iOS devices in supervised mode (ABM/ADE enrolment) if you want Lost mode and location.

Steps

Progress 0/5

1.Revoke sessions and note the time↓
2.Confirm encryption status↓
3.For supervised iOS: enable Lost mode first↓
4.Trigger the right action↓
5.If the device was corporate and stolen↓

Progress is saved in this browser only.

1. Revoke sessions and note the time

In Entra, on the user, Revoke sessions. Tokens on the lost device stop refreshing; Exchange, SharePoint, and Teams cut off within minutes. Record the time the loss was reported in the ticket — it bounds any later investigation.

2. Confirm encryption status

Intune → Devices → the device → Hardware shows Encrypted: Yes/No; Recovery keys lists escrowed BitLocker keys. For macOS, Recovery keys likewise. If the device was encrypted with a TPM-backed BitLocker and a PIN or Windows Hello, data at rest is protected regardless of whether the wipe ever lands.

3. For supervised iOS: enable Lost mode first

Devices → the device → Lost mode → Turn on, with a message and a phone number for the lock screen. Then Locate device to get a location. Lost mode locks the device without wiping, which is preferable if there is a real chance of recovery. Windows and Android have no equivalent in Intune; Android Enterprise fully-managed devices can be locked with Remote lock.

4. Trigger the right action

Devices → the device → (top bar):

Wipe (corporate, lost or stolen): choose Wipe device, and continue to wipe even if device loses power for a stolen device so an interrupted reset does not leave data; leave Retain enrollment state and user account unticked. Windows devices registered with Autopilot keep their Autopilot registration and will re-provision if recovered.
Retire (personal, enrolled): removes company apps, data, and policies; the device drops out of Intune and Entra compliance.
App selective wipe (personal, app-protection only): Apps → App selective wipe → Create wipe request, pick the user and optionally the device. Microsoft 365 apps under the policy clear their data at next launch.

Confirm the action; it shows as Pending under Device actions status.

5. If the device was corporate and stolen

Mark the Entra device object disabled (Entra → Devices → the device → Disable) so it cannot be used to satisfy a device-based Conditional Access policy, and remove the Autopilot registration only if you do not expect recovery. Report the theft to the police if insurance requires; the serial number is on the Intune hardware page.

Verify

Device actions status on the device moves from Pending to Complete when the device checks in. For a device that never comes back online, it stays Pending indefinitely — after 30 days delete the device record from Intune and Entra to keep inventories honest.
Sign-in logs show no successful sign-ins from the user's account after the revocation, or any that appear are from known devices.
For selective wipe, App selective wipe → the request shows Completed per app once the apps have launched.

Roll back

A Wipe cannot be undone; a recovered device is simply re-provisioned (Autopilot handles this for Windows) and the user's data comes back from OneDrive with Known Folder Move and from the mailbox. If the device turns up before it checked in, cancel the action from Device actions status — but only if you are sure it never left friendly hands; a device that was out of your control for a weekend should be wiped anyway. Retire and selective wipe are reversed by re-enrolling or re-signing into the apps.

Frequently asked questions

What is the difference between Wipe and Retire in Intune?

Wipe resets the device to factory state, removing everything — user data, apps, the OS configuration — and is the lost-or-stolen action. Retire removes company data, apps, and policies Intune deployed but leaves personal data and the OS intact, and is the leaver-with-a-personal-device action. Both unenrol the device; only Wipe destroys data.

What happens if the lost device is switched off or offline?

The wipe is queued and executes the next time the device checks in with Intune, which requires it to be powered on and connected. Until then, the data is protected only by the device's own controls — BitLocker or FileVault, the lock screen PIN, and the fact that sessions were revoked. That is why revoking the user's sessions and (for corporate devices) confirming disk encryption are the first steps, not the wipe.

Can I wipe a personal phone that only has Outlook and Teams?

If the device is enrolled (MDM), Retire removes work data. If it is unenrolled and only managed through app protection policies, use App selective wipe: it removes data from the Microsoft 365 apps for that user without touching anything else on the phone. Never Wipe a personal device you do not own; it is a factory reset of somebody's personal property.