Manage and maintain devices · Topic 9 of 9
Remote Actions, Bulk Actions, Device Query and Diagnostics
MD-102 remote actions: sync, restart, retire, wipe, bulk actions, rotate keys and passwords, update Defender, run KQL device queries and collect diagnostics.
- 5 min
- Retire keeps personal data. Wipe erases everything. Delete removes only the record.
- Retire, wipe and delete take precedence over other pending actions.
- Bulk actions cover up to 100 devices (25 for collect diagnostics), and daily limits are 500 wipes and 1,000 retires or deletes.
What it is
Remote actions let an administrator act on an enrolled device from the Intune admin center without touching it. They include basic ones (sync, restart, retire, wipe), security ones (rotate BitLocker keys and local admin passwords, update Defender intelligence) and investigation ones (device query and collect diagnostics). Bulk actions run an action on many devices at once.
How it works
Core actions
| Action | Effect |
|---|---|
| Sync | Forces the device to check in now and pick up pending actions and policies |
| Restart | Windows is forced to restart within five minutes, and the user is not warned, so work can be lost |
| Retire | Removes the device from Intune and removes managed apps, settings and profiles, but keeps personal data. Used for BYOD and leaving users |
| Wipe | Factory reset, which erases everything. Options include Retain enrollment state and user account, and Retain data plan on mobile (or remove it) |
| Delete | Removes the device record from Intune, but does not touch the device |
| Fresh Start | Windows reinstall that removes OEM apps but keeps user data |
| Autopilot Reset | Returns an Autopilot device to a business ready state, keeping it enrolled |
| Lock, Locate, Reset passcode | Mobile only actions |
Precedence: Retire, wipe and delete override other pending actions. Retire and wipe run the next time the device checks in.
Daily tenant limits count individual, bulk and Graph requests together: wipe is limited to 500 a day, and retire and delete to 1,000 each. Support can raise them.
Security related actions
- Rotate BitLocker recovery key: for Windows 10 1909 and later and Windows 11. The BitLocker policy must have client driven rotation enabled and keys saved to Entra ID. You need the Rotate BitLockerKeys permission.
- Rotate local admin password: rotates the Windows LAPS password and restarts its age timer. It needs a successful earlier backup.
- Rotate FileVault recovery key: for corporate macOS devices that escrowed the key to Intune.
- Update Microsoft Defender Antivirus security intelligence: pulls the latest definitions, and does not start a scan. Quick scan and Full scan actions exist too.
- Collect diagnostics and Run remediation (on demand) are covered below and on the remediations page.
Bulk device actions
Go to Devices, All devices, Bulk device actions. Pick the OS and the action, select devices, then create the action.
- Most actions support up to 100 devices at a time.
- Collect diagnostics supports up to 25 Windows devices at a time.
- Cloud PCs support up to 5,000 at a time.
- Check progress under Devices, Device actions.
- Bulk wipe, retire and delete count toward the daily tenant limits.
Device query
Device query runs a KQL query on a device and returns live data, such as installed apps, BitLocker status or running processes. On Windows, open the device, then Monitor, Device query, enter the query and Run. Limits to know: only a subset of KQL operators is supported, query text is limited to 2,048 characters, results are cut at 128 KB, and you can run 15 queries a minute. A multi device query is part of Intune Advanced Analytics. Copilot in Intune can help write the KQL. Queries read data and do not change anything.
Collecting diagnostics
Collect diagnostics gathers logs from a managed Windows device without interrupting the user, so you do not need physical access or the user to send logs.
- The device must be online. Diagnostics are retained for 28 days, and a device can hold up to 10 collections.
- You need the Collect diagnostics remote task permission, which Help Desk Operator and School Administrator include. Collection cannot be called directly through Microsoft Graph.
- Download the zip from the device's Device diagnostics list.
The Troubleshooting blade
Under Troubleshooting + support, Troubleshoot, search for a user by name or email. The blade shows that user's devices, assignments, compliance, app installation status, enrollment and diagnostics, so a help desk operator can solve user based issues without a device. If it shows "not enough permissions" with no data, the user often has no Intune license. For app problems, Managed Apps shows each app's assignment status and raw error code, with Collect diagnostics from the installation details.
Choosing the right action
| Situation | Action |
|---|---|
| Lost corporate device with sensitive data | Wipe |
| Employee leaves, personal device used for work | Retire |
| Policy changes are not arriving | Sync |
| BitLocker key was exposed | Rotate BitLocker recovery key |
| Local admin password may be known | Rotate local admin password |
| Need logs from a user's laptop | Collect diagnostics |
| Need current app list | Device query |
A worked scenario
A technician learns that a contractor's laptop was lost. She sends a wipe (a second admin approves it through Multi Admin Approval), then rotates the local admin password for sibling devices. A user complains about slow sign in, so she uses the Troubleshooting blade to find the device and collects diagnostics. She runs a device query to list startup programs, and bulk syncs 90 devices after a policy change.
What to remember for the exam
- Retire keeps personal data. Wipe erases everything. Delete removes only the record.
- Retire, wipe and delete take precedence over other pending actions.
- Bulk actions cover up to 100 devices (25 for collect diagnostics), and daily limits are 500 wipes and 1,000 retires or deletes.
- Device query uses KQL on one device (2,048 character limit, 15 queries a minute). Diagnostics are kept 28 days.
- Rotate actions exist for BitLocker keys, local admin passwords and FileVault keys.
BYOD offboarding is retire. Lost corporate device is wipe.
How the exam asks about this
- "An employee leaves and used a personal phone for work email." Retire.
- "Get the logs from a Windows device without disturbing the user." Collect diagnostics.
- "Find which devices have a specific app installed right now." Device query with KQL.
- "Update antivirus definitions without scanning." Update Microsoft Defender Antivirus security intelligence.
Common mistakes
Wiping a personal device. Retire removes only company data.
Expecting a restart to warn the user. It does not.
Forgetting daily tenant limits. Large wipes can be throttled.
Running diagnostics on an offline device. It must be online.
Check yourself
Which action removes company data but keeps personal data?
Retire.
How many devices does a standard bulk action support?
Up to 100.
What language does device query use?
KQL.
Topic 9 of 9 in Manage and maintain devices
Test yourself on Manage and maintain devices
The full Microsoft MD-102 question bank has 658 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.