Month 3: Hands off, help from here

Everyday actions

Open a device under Devices > All devices to see its actions. Sync makes the device check in now instead of at its next scheduled check-in, so new policies and apps arrive sooner. Restart reboots it remotely. Rename changes the device name. All are logged, and their status shows under Devices > Device actions.

Exam tip "User fixed the problem, now Intune should see it": Sync. Nothing gets deleted.

Retire vs wipe

Retire removes company data, managed apps, profiles and management, but leaves personal data. Use it for BYOD or when someone leaves and keeps their phone. Wipe factory-resets the device and erases everything: for lost or stolen corporate devices, or before reuse. On Windows, wipe can keep enrollment state and user account, or continue even if power is lost.

Exam tip Personal phone + employee leaving = Retire. Company laptop stolen = Wipe. Daily tenant limits: 500 wipes, 1,000 retires, 1,000 deletes.

Windows reset options

Autopilot Reset returns a Windows device to a business-ready state: it removes personal files, apps and settings but keeps the Entra join and Intune enrollment, ready for the next user. Fresh Start reinstalls Windows and removes OEM apps (it can keep user data). Delete removes the device record from Intune and sends a Retire (a Wipe on corporate Android).

Action           Keeps join  Keeps data
Retire           no          personal
Wipe             optional    no
Autopilot Reset  yes         no
Fresh Start      with data   optional

Bulk device actions

Need to act on many devices? Devices > All devices > Bulk device actions: pick the OS, the action (restart, sync, rename, retire, wipe, delete, Autopilot Reset, collect diagnostics) and up to 100 devices at once. Bulk wipe, retire and delete still count against the daily tenant limits. For larger jobs, script it with Microsoft Graph.

Exam tip Multi admin approval can protect wipe, retire and delete, including bulk ones.

Defender and key rotation actions

Update Windows Defender security intelligence tells Microsoft Defender Antivirus to fetch the newest definitions now. Quick scan and Full scan start a scan. BitLocker key rotation creates a new recovery password and escrows it to Entra ID. It needs the old key escrowed and recovery password rotation turned on in the BitLocker policy. Rotate local admin password makes LAPS set a new password immediately.

Exam tip A recovery key was read aloud, typed on a shared screen or emailed? Rotate it, so the exposed key stops working.

Device query with KQL

With Advanced Analytics, device query asks a device live questions in KQL (Kusto Query Language). Open the device, then Monitor > Device query. Entities include WindowsService, Process, EncryptableVolume, Certificate, LocalUserAccount, WindowsRegistry and WindowsEvent. Devices > Device query runs queries across many devices; Windows devices need a properties catalog policy to collect that inventory.

WindowsService
| where ServiceName == "WinDefend"
| project ServiceName, State, StartMode

EncryptableVolume
| project WindowsDriveLetter,
  ProtectionStatus, EncryptionPercentage

Collect diagnostics and the Troubleshoot pane

Collect diagnostics pulls logs, event logs and key registry data from a Windows device into a zip you download from the device's Device diagnostics page. For user-based troubleshooting, open Troubleshooting + support > Troubleshoot and pick the user. Tabs show their devices, groups, policies, apps, app protection, updates, enrollment restrictions and diagnostics.

Exam tip Ticket about one person ("Rosa's apps won't install"): start in Troubleshoot with Rosa's account. Ticket about one device: start on the device page.

How to run one

In Devices > All devices, select Bulk device actions, pick the OS and the action, choose up to 100 devices, then review and create. Each device then gets the action like a normal remote action.

• Restart, Sync, Rename (with a naming pattern)
• Retire (remove company data) and Wipe (factory reset)
• Delete (remove the record from Intune)
• Autopilot Reset, Collect diagnostics, and others depending on the OS

Things to remember

Bulk actions respect RBAC and scope tags, and in tenants with Multi Admin Approval a bulk wipe/retire/delete can become an approval request. Use filters or groups to pick devices rather than clicking one by one, and check each device's action status afterwards.

Exam tip More than 100 devices: run several batches or use Microsoft Graph.

Why rotate

A BitLocker recovery key (the 48-digit recovery password) unlocks a drive when BitLocker blocks startup. Once a help desk worker reads a key out to a user, it's no longer secret, so it should be rotated: BitLocker makes a new recovery password and escrows it.

How it works in Intune

Turn on client-driven recovery password rotation in the BitLocker policy (Endpoint security > Disk encryption). Then either Windows rotates the key automatically after it's used, or an admin runs the BitLocker key rotation device action on a device. The new key is backed up to Microsoft Entra ID and visible on the device's Recovery keys page.

• Device must be Entra-joined or hybrid-joined, with key escrow to Entra ID working
• Supported on current Windows 10/11 versions
• Rotation fails if the device can't back up the new key

Exam tip Users can see their own keys at the My Devices / account portal for self-service.

The problem LAPS solves

If every PC has the same local Administrator password, one leak opens every PC. Windows LAPS (Local Administrator Password Solution, built into Windows) gives each device its own random local admin password, rotates it on a schedule, and backs it up to Microsoft Entra ID (or on-premises AD).

Setting it up in Intune

Create a Local admin password solution (Windows LAPS) policy under Endpoint security > Account protection: backup directory (Entra ID), password age (days), complexity, length, which account to manage, and what to do after the password is used (post-authentication actions such as reset the password and log off). Turn on LAPS in Entra ID device settings too.

• View a password: the device's Local admin password page in Intune (needs permission)
• Rotate now: the Rotate local admin password device action
• Every view is audited

Exam tip Password just got used for a support call and must change now: run Rotate local admin password, don't wait for the age to expire.