Three buttons in the Intune admin center cause more confusion than any others: Retire, Wipe and Delete. They sound similar, they all make a device go away in some sense, and picking the wrong one can mean an employee loses family photos or a stolen laptop keeps its company data. Understanding Intune wipe vs retire, and where Delete fits, is one of the most practical skills an IT team can have.
This guide explains what each action actually does, when to use it, and the cleanup steps that most offboarding checklists miss. These actions are available with any Intune license, including Microsoft 365 Business Premium, E3 and E5.
The short version
Action
What it removes
Personal data
Device stays enrolled?
Use it when
Retire
Company apps, data, profiles and settings delivered by Intune
Kept
No
A BYOD user leaves, or a personal device should no longer be managed
Wipe
Everything: factory reset
Erased
No, unless you choose to keep enrollment on Windows
A company device is lost, stolen or being reissued
Delete
The Intune record, and it sends a retire or wipe
Depends on platform
No
A device is gone for good and you want the record cleaned up
Retire: remove the company, keep the person
Retire unenrolls the device and removes managed apps, email profiles, Wi-Fi and VPN profiles, certificates and settings that Intune delivered. Personal apps, photos and files stay in place. That makes it the right action for personally owned phones and laptops.
Two details matter:
Retire runs on the next check-in. Until the device contacts Intune, it shows as retire pending. A phone that is switched off sits in that state until it reconnects or its management certificate expires.
Retire does not revoke sign-in tokens. If a user can still sign in to Microsoft 365, they can still reach company data from the browser or reinstall apps. Retiring a device is a device action, not an identity action. Disable the account or revoke sessions in Microsoft Entra ID as well.
Only apps that Intune installed are removed. An app the user installed from the store themselves is not a managed app, so it stays, although app protection policies can still wipe company data inside Outlook or Teams on that device.
Wipe: back to factory settings
Wipe restores the device to factory settings and removes all data. Use it for company-owned devices that are lost, stolen, being reissued to someone else, or leaving the business.
On Windows, the wipe dialog gives you options worth understanding:
Keep enrollment state and associated user account. Resets the device but keeps it enrolled and the user’s account. Useful for repairing a broken build without starting over.
Continue to wipe even if the device loses power. A protected wipe that is harder for a user to interrupt. Some devices may not start again afterward, so use it for genuine security cases, not routine resets.
If the device is registered with Windows Autopilot or Apple Automated Device Enrollment, a wiped device re-enrolls into your tenant during setup. That is exactly what you want for a stolen laptop: it is useless to anyone outside your organization.
Wipe is not available for personally owned Android work profile devices. Google does not allow an MDM to factory reset a personal phone, and that is a sensible privacy rule.
Delete: clean up the record
Delete removes the device from the Intune admin center straight away. It also sends a command to the device, and which command depends on the platform:
Windows, iOS/iPadOS and macOS: a retire.
Android personally owned work profile and device administrator: a retire.
Android fully managed, dedicated and corporate-owned work profile: a wipe.
Use Delete for devices that have already been wiped, disposed of, or have not checked in for months. Do not use it as a shortcut to retire a device you still care about, because the record and its history disappear from view immediately.
The cleanup steps most checklists miss
An Intune action is only one part of removing a device. In the tenants I review, the leftovers below cause the most confusion months later.
Back up the BitLocker recovery key first. Retiring or deleting a Microsoft Entra joined Windows device can remove key protectors and suspend BitLocker. If you might need data from that disk, record the key before you act.
Remove the Microsoft Entra ID device object when the device is truly gone. The Intune record and the Entra record are separate. Stale Entra devices clutter Conditional Access reports and group membership.
Deregister from Windows Autopilot if you are selling or donating the hardware. Otherwise the next owner’s setup will try to join your tenant.
Release from Apple Business Manager for Apple devices leaving the business. A device still assigned to your Intune server reappears on the next full sync even after you delete it.
Revoke the user’s sessions in Entra ID during offboarding, because device actions do not touch sign-in tokens.
Check who did it. Device actions are logged at Tenant administration > Audit logs. If a user retired their own device through Company Portal, you will find it under Devices > Monitor > Device actions.
Other actions that are often the better choice
Not every problem needs a wipe. Windows has two gentler resets:
Autopilot Reset removes user data, settings and apps but keeps the device enrolled and joined, then reapplies your configuration. Ideal for handing a laptop to a new starter.
Fresh Start reinstalls the latest Windows and removes manufacturer bloatware, with the option to keep user data.
For a lost phone, start with remote lock or lost mode (on supervised iOS devices) and only escalate to wipe when you are sure it is not coming back.
Protect yourself from mistakes
A bulk wipe sent to the wrong group is a very bad day. Two controls help:
Least-privilege roles. Only give the Remote tasks wipe permission to people who need it. Helpdesk staff often need retire and sync, not wipe.
Multi Admin Approval. Intune can require a second administrator to approve device wipe, retire and delete actions before they run. For businesses with more than one or two admins, it is worth turning on.
Intune also caps device actions per tenant per day, for example 500 wipes and 1,000 retires or deletes, counted across the portal, bulk actions and Graph. That limit rarely matters for smaller businesses, but it is a useful safety net.
If you would like these steps built into a repeatable offboarding process, our Intune managed service handles device lifecycle for you, and an Intune health check will surface stale and orphaned devices.
Frequently asked questions
Does retiring a device sign the user out of Microsoft 365?
No. Retire removes managed apps and data from the device but does not revoke access tokens. Revoke the user’s sessions in Microsoft Entra ID and use Conditional Access to block access from unmanaged devices.
What happens if I wipe a device that is offline?
The wipe stays pending until the device checks in. If it never reconnects before its management certificate expires, the command never runs, so pair the wipe with account and session revocation.
Should I retire or wipe a company laptop when someone leaves?
Usually neither on its own. For a laptop that will be reissued, Autopilot Reset or a wipe that keeps enrollment prepares it for the next person. Use a full wipe when the device is leaving the business or its state is unknown.
Not sure your offboarding actually removes company data? Book a free Microsoft 365 security assessment and we will review your device and identity offboarding steps.
Three buttons in the Intune admin center cause more confusion than any others: Retire, Wipe and Delete. They sound similar, they all make a device go away in some sense, and picking the wrong one can mean an employee loses family photos or a stolen laptop keeps its company data. Understanding Intune wipe vs retire, and where Delete fits, is one of the most practical skills an IT team can have.
This guide explains what each action actually does, when to use it, and the cleanup steps that most offboarding checklists miss. These actions are available with any Intune license, including Microsoft 365 Business Premium, E3 and E5.
The short version
Retire: remove the company, keep the person
Retire unenrolls the device and removes managed apps, email profiles, Wi-Fi and VPN profiles, certificates and settings that Intune delivered. Personal apps, photos and files stay in place. That makes it the right action for personally owned phones and laptops.
Two details matter:
Only apps that Intune installed are removed. An app the user installed from the store themselves is not a managed app, so it stays, although app protection policies can still wipe company data inside Outlook or Teams on that device.
Wipe: back to factory settings
Wipe restores the device to factory settings and removes all data. Use it for company-owned devices that are lost, stolen, being reissued to someone else, or leaving the business.
On Windows, the wipe dialog gives you options worth understanding:
If the device is registered with Windows Autopilot or Apple Automated Device Enrollment, a wiped device re-enrolls into your tenant during setup. That is exactly what you want for a stolen laptop: it is useless to anyone outside your organization.
Wipe is not available for personally owned Android work profile devices. Google does not allow an MDM to factory reset a personal phone, and that is a sensible privacy rule.
Delete: clean up the record
Delete removes the device from the Intune admin center straight away. It also sends a command to the device, and which command depends on the platform:
Use Delete for devices that have already been wiped, disposed of, or have not checked in for months. Do not use it as a shortcut to retire a device you still care about, because the record and its history disappear from view immediately.
The cleanup steps most checklists miss
An Intune action is only one part of removing a device. In the tenants I review, the leftovers below cause the most confusion months later.
Tenant administration > Audit logs. If a user retired their own device through Company Portal, you will find it underDevices > Monitor > Device actions.Other actions that are often the better choice
Not every problem needs a wipe. Windows has two gentler resets:
For a lost phone, start with remote lock or lost mode (on supervised iOS devices) and only escalate to wipe when you are sure it is not coming back.
Protect yourself from mistakes
A bulk wipe sent to the wrong group is a very bad day. Two controls help:
Intune also caps device actions per tenant per day, for example 500 wipes and 1,000 retires or deletes, counted across the portal, bulk actions and Graph. That limit rarely matters for smaller businesses, but it is a useful safety net.
If you would like these steps built into a repeatable offboarding process, our Intune managed service handles device lifecycle for you, and an Intune health check will surface stale and orphaned devices.
Frequently asked questions
Does retiring a device sign the user out of Microsoft 365?
No. Retire removes managed apps and data from the device but does not revoke access tokens. Revoke the user’s sessions in Microsoft Entra ID and use Conditional Access to block access from unmanaged devices.
What happens if I wipe a device that is offline?
The wipe stays pending until the device checks in. If it never reconnects before its management certificate expires, the command never runs, so pair the wipe with account and session revocation.
Should I retire or wipe a company laptop when someone leaves?
Usually neither on its own. For a laptop that will be reissued, Autopilot Reset or a wipe that keeps enrollment prepares it for the next person. Use a full wipe when the device is leaving the business or its state is unknown.
Microsoft’s full list of actions by platform is on the Intune device actions page on Microsoft Learn. For a broader view of device lifecycle, see our Intune services.
Not sure your offboarding actually removes company data? Book a free Microsoft 365 security assessment and we will review your device and identity offboarding steps.