6.4MD-102Intermediate

Est: ~15 mins•Verified: 2026-08

Device Lifecycle: Remote Actions & Recovery

Master remote device actions across the employee lifecycle: Wipe vs Retire vs Fresh Start vs Autopilot Reset, and BitLocker recovery key retrieval via Entra ID.

Tags:#Lifecycle#Wipe#Retire#Fresh Start#Autopilot Reset#BitLocker Recovery#MD-102

Overview

Managing the device lifecycle—from active employment, to device re-purposing, theft, lost hardware, and employee offboarding—requires understanding the exact operational nuances of Microsoft Intune Remote Actions:

Retire: Removes corporate data, configuration profiles, certificates, and MDM management while leaving all personal data intact. The device un-enrolls from Intune.
Wipe (Factory Reset): Restores the machine to original factory Out-of-Box Experience (OOBE) defaults, deleting all user data, personal files, and installed software.
Fresh Start: Reinstalls a clean version of Windows 10/11, removing pre-installed OEM bloatware while optionally preserving user data profiles.
Autopilot Reset: Resets the device to a fully configured, business-ready state (removing personal accounts while keeping Entra join and Intune enrollment), ready for the next employee in under 20 minutes.
BitLocker Key Escrow Recovery: Instantly retrieves 48-digit numerical recovery passwords when a user is locked out by firmware changes or TPM failures.

---

When to Use: Remote Action Decision Matrix

Remote Action	Corporate Data	Personal Data	Entra / MDM State	Best Used For
Retire	Removed	Preserved	Device un-enrolled	Employee departures with personal BYOD devices (Windows, iOS, Android).
Wipe	Removed	Removed	Factory Defaults (OOBE)	Stolen / lost laptops, or devices transitioning to a completely different user.
Fresh Start	Removed	Optional Keep	Clean OS Reinstall	Removing vendor OEM bloatware on new retail laptops.
Autopilot Reset	Maintained	Removed	Remains Entra Joined	Rapid re-assignment of shared or corporate devices without re-enrolling.

---

Prerequisites

Administrator Permissions:

Intune Role: Intune Administrator, Help Desk Operator, or Endpoint Security Manager.
BitLocker Key Reader: Role in Microsoft Entra ID or Intune (Global Reader or BitLocker Key Reader).

Endpoint Connectivity:

Device must have active internet connectivity (cellular, Ethernet, Wi-Fi) to receive the push notification from the Microsoft Notification Service (WNS / APNs).

---

Portal Path

TEXT

Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Devices
    └── All devices > [Select Target Device]
        ├── Overview top bar:
        │   ├── Sync
        │   ├── Restart
        │   ├── Autopilot Reset
        │   ├── Fresh Start
        │   ├── Retire
        │   └── Wipe
        └── Monitor > Recovery keys (BitLocker 48-digit password)

---

Step-by-Step Implementation

Step 1: Performing a Controlled Device Wipe

In Intune Admin Center, navigate to Devices > All devices > Select target device.
In the top action bar, click Wipe.
Configure wipe options:

Wipe device, and continue to wipe even if device loses power: Check if decommissioning or disposing of hardware.
Wipe device, and keep enrollment state and associated user account: Check if refreshing OS while maintaining user identity.

Click Yes to confirm. The device restarts and begins disk formatting within 5–15 minutes.

Step 2: Retrieving BitLocker Recovery Keys via Intune

Select the locked target device in Intune > Devices > All devices.
Under the Monitor section on the left menu, select Recovery keys.
Locate the matching Key ID shown on the user's blue BitLocker recovery screen.
Click Show Recovery Key.
The 48-digit numerical password appears (e.g., 123456-789012-345678...). Read this to the user to unlock their drive.

---

PowerShell Automation

Trigger Remote Device Sync via Microsoft Graph PowerShell:

PowerShell

Connect-MgGraph -Scopes "DeviceManagementManagedDevices.PrivilegedOperations.All"

# Find managed device ID
$Device = Get-MgDeviceManagementManagedDevice -Filter "deviceName eq 'CORP-WIN11-042'"

# Send instant Remote Sync command to force policy check-in
Sync-MgDeviceManagementManagedDevice -ManagedDeviceId $Device.Id

Remotely Trigger Autopilot Reset:

PowerShell

# Executes Autopilot Reset on targeted device
Invoke-MgDeviceManagementManagedDeviceWindowsDefenderScan -ManagedDeviceId $Device.Id
# Or trigger Autopilot Reset directly:
$Uri = "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices('$($Device.Id)')/cleanWindowsDevice"
Invoke-MgGraphRequest -Method POST -Uri $Uri

---

Microsoft Graph Automation

Query Escrowed BitLocker Recovery Key via Graph:

PowerShell

Connect-MgGraph -Scopes "BitlockerKey.Read.All"

# Retrieve all BitLocker keys escrowed in Microsoft Entra ID
$BitlockerKeys = Get-MgInformationProtectionBitlockerRecoveryKey -All

# Query specific 48-digit recovery password for a known Key ID
$TargetKeyId = "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
Get-MgInformationProtectionBitlockerRecoveryKey -BitlockerRecoveryKeyId $TargetKeyId -Property "key" |
    Select-Object id, createdDateTime, deviceId, key

---

Verification Checklist

VERIFICATION CHECKLIST

0/5 (0%)

Target device acknowledges remote command and executes reboot.

For Retire: Device disappears from Intune MDM, corporate Wi-Fi profiles are removed, personal files remain.

For Wipe: Machine formats storage partitions and reboots into clean OOBE setup.

For Autopilot Reset: Machine wipes local user profile, returns to initial corporate login, maintains Entra Join.

BitLocker audit logs in Entra ID record the identity of the administrator who viewed the recovery key.

Diagnostic Logs & Channels

Channel / Tool	Log Location	Purpose
Audit Logs (Intune)	Intune Admin Center > Tenant administration > Audit logs	Audits which administrator initiated Wipe, Retire, Restart, or Key Reveal actions.
Push Notification Client (WNS)	`Microsoft-Windows-PushNotifications-Platform/Operational`	Tracks delivery of remote push commands from Microsoft Cloud to client machine.
BitLocker Management Event Log	`Applications and Services Logs > Microsoft > Windows > BitLocker-API > Management`	Logs recovery key backup successes and escrow failures to Entra ID.

---

Troubleshooting Matrix

Error Code / Symptom	Root Cause	Exact Resolution
Remote Action shows "Pending" forever	Device is powered off, in sleep mode, disconnected from Wi-Fi, or firewall blocks WNS.	Device will execute command automatically as soon as it reconnects to internet.
"BitLocker key not found" in portal	BitLocker was enabled manually before enrollment, or escrow policy was not applied.	Run elevated PowerShell to backup key manually: `BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId` .
Retire did not remove personal files	This is the intended design behavior of Retire.	If full erasure was intended, issue a Wipe instead of a Retire.

---

Production Best Practices

Production Best Practice

Audit BitLocker Key Access:

Viewing a BitLocker recovery key is a sensitive administrative action. Regularly review the Audit logs in Microsoft Entra ID (Filter by Activity: Read BitLocker key) to detect unauthorized key viewing.

Security Caution

Fresh Start on Non-Standard Hardware:

When issuing a Fresh Start, Windows reinstalls using the default generic Windows image. Ensure critical storage or network drivers are available, or use Autopilot Reset if proprietary hardware drivers are required.

---

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

Retire vs Wipe: Retire preserves personal data and removes corporate data (ideal for BYOD). Wipe wipes everything back to factory defaults.
Autopilot Reset Advantage: Autopilot Reset maintains the Microsoft Entra join and MDM enrollment state; it does not require running through OOBE again.
Fresh Start Options: Fresh Start can optionally retain user data by checking Retain user data on this device.

---

Official Documentation

PREVIOUS TOPIC6.3 Endpoint Analytics & Proactive Remediations