Intune gives you several ways to take data off a device, and the wrong one either leaves company data behind or erases far more than you meant to. In this post I'll compare wipe, retire, Fresh Start, Autopilot Reset and delete, list what each needs before it will run, and work through the reasons an action sits on Pending or fails.
Errors this guide fixes
Error code: ERROR_NOT_SUPPORTED (0x80070032)Autopilot Reset (device logs)
What each action does#
| Action | Platforms | Removes | Keeps |
|---|---|---|---|
| Retire | Windows, iOS/iPadOS, macOS, tvOS, visionOS, personally owned Android work profiles (and legacy Android device administrator) | The company apps, data and settings Intune manages: profiles, certificates, Wi-Fi and VPN settings. On personal Android, the whole work profile. | Personal apps and data. The device leaves Intune; the Microsoft Entra record stays for Apple devices and Autopilot-registered PCs, but is removed for other Entra joined or registered PCs. |
| Wipe | Windows, iOS/iPadOS, macOS, tvOS, visionOS, corporate-owned Android (dedicated, fully managed, work profile), AOSP, ChromeOS | Everything: a factory reset (on Zebra Android devices, only corporate data) | Nothing, unless you choose to keep enrollment state on Windows. Devices registered in Autopilot, Apple Business or zero-touch enroll again during setup. |
| Fresh Start | Windows | Apps, including the manufacturer's preinstalled apps, and settings | With Retain user data on this device: the Entra join and the Home folder contents |
| Autopilot Reset | Windows, Microsoft Entra joined and MDM-managed | Personal files, apps and settings; reapplies the original settings, region, language and keyboard | Entra join, Intune enrollment, Wi-Fi details, provisioning packages, SCEP certificates |
| Delete | All | Only the Intune record | The device itself is untouched |
Prerequisites#
- Roles. Wipe works with Help Desk Operator, School Administrator, or a custom role with Remote tasks › Wipe. Fresh Start adds Endpoint Security Manager, and its custom permission is Remote tasks › Clean PC. Microsoft's Autopilot documentation lists the Intune Service Administrator (Intune Administrator) role for a remote Autopilot Reset. Retire has its own permission, Remote tasks › Retire.
- Limits. A tenant can submit up to 500 wipe actions per day (1,000 for retire), counting single, bulk and Microsoft Graph requests together.
- Approvals. If a Multi Admin Approval access policy covers the action, a second administrator must approve it first.
- Connectivity. Actions run when the device next checks in, so it must be online.
- Windows recovery. Autopilot Reset needs the Windows Recovery Environment (WinRE) configured and enabled, and a broken recovery environment can stop wipe and Fresh Start too. Check it with
reagentc /info; good looks likeWindows RE status: Enabled.
Step-by-step#
Retire a personal or departing device#
In the Microsoft Intune admin center, open Devices › All devices, select the device and choose Remove data › Retire. On personally owned Android work profile devices, Retire is the only option; Wipe isn't offered there. On a Microsoft Entra joined PC, retire also unjoins the device, so Entra accounts can no longer sign in, and on BitLocker-protected PCs Intune removes the key protectors. Back up the BitLocker recovery key and local administrator credentials first.
Wipe a Windows device#
Select Remove data › Wipe and choose an option:
| Option | Effect | Use it for |
|---|---|---|
| Wipe device, but keep enrollment state and associated user account | Factory reset that keeps user data, accounts and key settings. MDM policies are removed, but the device stays enrolled (doWipePersistUserData). | Repairing a broken build without losing the user |
| Wipe device, and continue to wipe even if device loses power | Deletes everything, overwrites free space and survives power loss (doWipeProtected) | Lost or stolen devices. It can leave some devices unable to start. |
| No option selected | Standard reset; tries to roll back if interrupted (doWipe) | Reassigning a device |
If the hardware is leaving the organization, also remove it from Windows Autopilot and then from Microsoft Entra ID. If you're redeploying it internally, leave both alone; a reused self-deploying or pre-provisioned device may only need its old Intune record cleared (see error 0x80180014).
Wipe Apple and Android devices#
Apple devices are erased; those assigned through Apple Business re-enroll in Setup Assistant. For corporate-owned Android, Microsoft documents that an Intune wipe doesn't trigger factory reset protection, even when factory reset protection emails are configured. That makes it the clean way to reprovision.
Fresh Start#
Select Remove data › Fresh Start. With Retain user data on this device selected, the PC stays Entra joined, re-enrolls in MDM automatically when an Entra user signs in, and keeps the Home folder. Without it, Windows returns to an out-of-box-experience-completed state that keeps the built-in administrator account. Microsoft also notes that BYOD devices are removed from Microsoft Entra ID and MDM.
Autopilot Reset#
- Remote: select the device and run Autopilot Reset from its actions. Afterwards the primary user and the Entra device owner are cleared; the next user to sign in becomes both. Shared devices stay shared.
- Local: deploy a Device restrictions profile with General › Autopilot Reset set to Allow (the
DisableAutomaticReDeploymentCredentialspolicy). Then press Ctrl+Win+R on the lock screen and sign in with a local administrator account. A local reset doesn't change the primary user. - Not supported on Microsoft Entra hybrid joined devices or Surface Hub; use a full wipe. A hybrid device can take up to 24 hours to be ready for redeployment, and re-registering it speeds that up.
Verify the action#
- The device's overview page shows the action and its status, and the tenant-wide Device actions report lists recent actions across all devices.
- Tenant administration › Audit logs shows who started each action. If you export logs (see Intune diagnostic settings), this query lists them. Fresh Start is the
cleanWindowsDeviceaction in Microsoft Graph.KQLIntuneAuditLogs | where TimeGenerated > ago(14d) | where OperationName contains "wipe" or OperationName contains "retire" or OperationName contains "clean" | project TimeGenerated, Identity, OperationName, ResultType | order by TimeGenerated desc - After an Autopilot Reset, the desktop stays blocked until provisioning packages are reapplied and an MDM sync completes; the device keeps its Intune record.
Why actions stay pending or fail#
| Symptom | Cause | Fix |
|---|---|---|
| Stuck on Pending | The device is off, offline or not checking in | Get it online and sync; a lost device runs the action at its next contact. If it will never return, delete the record and clean up Autopilot and Entra ID. |
| Apple devices ignore every action | The Apple MDM push certificate expired or was renewed with a different Apple Account | Renew it with the Apple Account that created it |
Autopilot Reset fails at once, logging Error code: ERROR_NOT_SUPPORTED (0x80070032) | WinRE isn't configured or enabled | Run reagentc.exe /enable and retry; if it still fails, Microsoft advises opening a support case |
| A Windows wipe or Fresh Start never finishes | Rule out a disabled or broken WinRE first | Check reagentc /info, enable WinRE, run the action again |
| A corporate Android device isn't factory reset | A fully managed Samsung device has Factory Reset blocked in a device restrictions profile, or it's a Zebra device, where Wipe removes only corporate data by design | Stop blocking Factory Reset before you wipe; reset Zebra devices with StageNow or OEMConfig |
| Autopilot Reset fails on a domain-joined PC | Hybrid joined devices aren't supported | Use a full wipe |
| Action greyed out or missing | Missing RBAC permission, or the platform or enrollment type doesn't support it | Check the role's Remote tasks permissions and the platform list above |
| Part of a bulk wipe rejected | The 500-a-day tenant limit | Spread it over several days, or ask Microsoft support to raise the limit |
| Waiting for approval | Multi Admin Approval | An approver completes the request |
Tip: Delete sends nothing to the device, so use it only for devices that are gone. Cleanup rules handle stale records automatically.
