Intune delete and wipe options - seek full explanation of each

Question

Intune delete and wipe options - seek full explanation of each

Paul Thomas 0

I would like a more detailed explanation as to what happens when we choose to Delete or Wipe a device from Intune.

Primarily concerned about data on the PC.

We have some devices we are going to need to remove from Intune and Entra and then re-enroll back in. (Duplicate device entry issues in Entra with non-matching Intune records).

A Microsoft Engineer said that files on the PC's that were downloaded from our M365 could be wiped by these two options (Delete/Wipe).

Its critical we understand under what circumstances this happens. For example, does it make a difference if the PC is Entra Registered or Joined? Or if the Device is marked as Corporate or Personal in Intune?

Understanding this is going to be beneficial to deal with the current issue, but also for dealing with leavers and ensuring Company data is removed from devices. Some could be Employees who return their laptop, others may be using BYOD and we also have SubContractors using their own BYOD devices.

1 answer

Your answer

Answer 1

Crystal-MSFT 53,991 Microsoft External Staff

@Paul Thomas, Thanks for posting in Q&A. For wipe action, it restores a device to its factory default settings. it is mainly useful for resetting a device before you give the device to a new user. Wipe it not supported with Android Enterprise personally owned devices with a work profile. For delete action, it removes devices from the Intune admin center. Depending on the device platform, it may retire the Microsoft Entra device record / unjoin the device from Microsoft Entra ID.

And for both wipe and delete on windows device, it is similar with Microsoft Entra Registered or Joined devices. For the company portal, whether it is removed, this depends on platform with delete action. For example, Android Enterprise work profile and macOS will delete company portal when you perform delete action. iOS, Windows will sign out company portal. You can see the details in the following link:

https://learn.microsoft.com/en-us/mem/intune/remote-actions/devices-wipe

Hope the above information can help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Paul Thomas 0 Reputation points

2024-06-28T05:34:57.8533333+00:00
Thankyou for covering the basics of these actions, the link is a useful read.

From what I have read on the link, for a Windows 10 and above PC, doing a Delete actually initiates a Retire:

RETIRE - All Profiles are deleted, work and school account is signed out

Thats still not clear enough for me.

In my scenario these are Entra Registered Windows devices, the user signs in with either a local or Microsoft account. Will that profile be removed? or does it only do this for Entra Joined devices, which have a Corporate login profile?

Does the ownership of Corporate or Personal make any difference?

In my scenario, I need to remove some Windows registered devices from Intune (and Entra), delete all related Intune/Entra records. Then re-enroll in Entra and Intune again, to ensure records match correctly. All without risking data on the PC.

(We have some duplicate device records in Entra, so removing everything and rejoining seems best option)
Crystal-MSFT 53,991 Reputation points Microsoft External Staff

2024-06-28T06:31:50.4066667+00:00

@Paul Thomas, Thanks for the reply. For the delete action on Microsoft Entra registered device, it will not remove the local user profile or a personal Microsoft account user profile. For the profiles it mentioned here is configuration profile like certificate profile, WiFi profile which deployed via Intune.For your scenario, you can delete the device records in both Intune and Microsoft Entra, Alos remove the registry keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\GUID to remove any remaining information of enrollment on the device side. Then re-enroll again.

Hope the above information can help.
Paul Thomas 0 Reputation points

2024-06-28T09:59:15.0466667+00:00

Thankyou, thats much clearer :) and does set my mind at rest. We will test next week with some test devices, just to be sure.

If its a Joined device, with a corresponding Corporate profile using their email address, is the behaviour different?

Which option removes the profile and data?

In the scenario its a SubContractor and we Join their device (which I prefer as it then creates that Corporate profile and login, encouraging our data to be kept within that), would deleting it just remove the Profile and MDM management, leaving their previous personal local or Microsoft profile alone?
Crystal-MSFT 53,991 Reputation points Microsoft External Staff

2024-07-01T01:29:41.8933333+00:00

@Paul Thomas, Thanks for the reply. I notice you want to test. We will wait for your update.

meanwhile, for delete action on Microsoft Entra joined device, it will trigger retire action which will remove Microsoft Entra ID record. Then the user profile for the company user will also remove from the device I think.

For your another question, I would like to say Yes, if the corporate profile and MDM management are deleted, it will leave their previous personal local or Microsoft profile unaffected. Essentially, the device will no longer be managed by your organization, but their personal data remains intact
Crystal-MSFT 53,991 Reputation points Microsoft External Staff

2024-07-05T02:07:15.08+00:00

@Paul Thomas, Long time not heard from you. I am writing to see if there's any update on our testing. If yes, feel free to let us know.
Paul Thomas 0 Reputation points

2024-07-05T06:23:55.5966667+00:00

Good morning

We are currently testing with a spare device, to try the different scenarios and documenting what happens in reality, rather than theory.

Any documentation I find online, from Microsoft, just warns about files being deleted in these scenarios. Which I would bet is just a warning. I need to understand what actually happens consistently.

I am still a little unclear what has caused the duplicate and mismatched records, which continues to be a concern in case we do something to cause it again in the future.
Crystal-MSFT 53,991 Reputation points Microsoft External Staff

2024-07-05T07:17:31.9633333+00:00

@Paul Thomas, Thanks for your reply. I understand you. Testing is a good option to avoid any impact in the environment in the future. Sometimes, the device in Microsoft Entra will be left for issue. For such scenario, you can refer to the following link to clear the stale device.

https://learn.microsoft.com/en-us/entra/identity/devices/manage-stale-devices

Share via

Intune delete and wipe options - seek full explanation of each

1 answer

Your answer