Remote Actions & Device Queries
From your desk, you can sync, restart, wipe, or retire any managed device. Plus: run real-time KQL queries to investigate device issues without waiting for inventory sync.
Remote actions overview
Think of remote actions like a building manager’s control panel.
From one screen, you can lock any door, turn off any light, reset any alarm, or — in extreme cases — evacuate a floor. You don’t need to physically walk to each room. Intune’s remote actions give you the same power over managed devices: sync policies, restart a frozen laptop, wipe a stolen phone, or retire an old device — all from the Intune admin center.
The remote actions you need to know
| Feature | Sync | Restart | Retire | Wipe |
|---|---|---|---|---|
| What it does | Forces policy/app check-in | Reboots the device | Removes company data only | Factory resets the entire device |
| User data preserved | Yes | Yes | Personal data stays | No — everything deleted |
| Company data preserved | Yes | Yes | Removed | Removed |
| Device stays enrolled | Yes | Yes | No — unenrolled | No — unenrolled |
| Use case | Force a policy to apply NOW | Fix a frozen device | Employee leaves — clean corporate data | Device stolen — nuke everything |
| Reversible | Yes | Yes | No | No |
| Destructiveness | None | Low (just a reboot) | Medium (company data gone) | High (everything gone) |
When Riko uses each action at Pixel & Co
| Scenario | Action | Why |
|---|---|---|
| Designer says “my new app isn’t showing up” | Sync | Forces the device to check in and download pending apps/policies |
| Designer’s Mac is frozen and they’re remote | Restart | Reboots without needing the designer to hold the power button |
| Designer leaves the company (personal iPhone with work profile) | Retire | Removes company email, apps, and data — personal photos stay |
| Company iPad stolen from the office | Wipe | Factory reset — all data destroyed, device returns to OOBE |
| Intern’s laptop has malware | Wipe | Clean slate — reimaging is safer than trying to clean the infection |
Bulk remote actions
For large-scale operations, Intune supports bulk actions:
- Intune admin center → Devices → All devices → Bulk device actions
- Select the action (restart, sync, retire, wipe, etc.)
- Select the target OS platform
- Choose devices (by filter, group, or manual selection)
- Confirm and execute
Example: Sam at Tui Solutions runs a bulk sync on all 500 Windows devices after deploying a critical security policy — ensuring every device picks it up within minutes.
Defender Antivirus security intelligence updates
You can force Microsoft Defender Antivirus to update its virus definitions immediately:
- Select the device in Intune admin center
- Remote action → Update Windows Defender security intelligence
- Device downloads the latest threat definitions from Microsoft
When to use: After a zero-day threat announcement — don’t wait for the scheduled update. Force all devices to get the latest definitions immediately.
BitLocker recovery key rotation
BitLocker encrypts the drive, and the recovery key is the “emergency key” that unlocks it if the normal method fails. Intune can:
- Store BitLocker recovery keys in Entra ID (automatic during encryption)
- View recovery keys in the Intune admin center (Devices → select device → Recovery keys)
- Rotate the recovery key after it’s been used or viewed
Key rotation: After a recovery key is used (e.g., helpdesk unlocked a device), the key should be rotated so the old key no longer works. Intune can do this automatically or via remote action.
Exam tip: retire vs wipe
This is one of the most commonly tested distinctions:
- Retire = company data only. Personal data survives. Device unenrolls from Intune. Use when an employee leaves or a personal device needs corporate cleanup.
- Wipe = everything. Factory reset. All data destroyed. Use for stolen/lost devices or devices being repurposed.
If the exam says “employee’s personal phone” + “they’re leaving the company” → Retire (don’t wipe their personal photos). If the exam says “corporate laptop stolen” → Wipe (destroy everything).
Diagnose the user’s assignments before resetting the device
The Troubleshooting blade, reached through Troubleshooting + support > Troubleshoot, starts with a user, not a destructive device action. Select the user and, if necessary, filter to the affected device.
| Question | Evidence to inspect |
|---|---|
| Is the user entitled to enroll? | Licence, enrollment restrictions, enrollment failure details, and device limit |
| Should this policy reach this device? | User/device group membership, assignments, exclusions, assignment filter, and platform applicability |
| Is an app missing or failing? | Assigned applications, installation status, and app protection status |
| Is the console showing recent state? | Device last check-in and the relevant policy or app result |
Worked diagnosis: A policy succeeds for the Sales group except for one user’s laptop. Check whether the device is actually included by the assignment and its filter before running repeated Sync actions. Sync can request a check-in; it cannot make an excluded or inapplicable policy apply.
For a supported Windows device, use Collect diagnostics when you need device-side logs. Track the collection status, download the resulting diagnostics when available, and inspect the logs for the failing enrollment, app, or policy operation. The user’s Troubleshooting view and a collected diagnostics package answer different parts of the investigation. Limit access to downloaded diagnostics because logs can contain identifying information.
A configuration policy is assigned to All devices with an include filter for corporate Windows laptops. One personally owned Windows laptop never receives it, even after a successful sync. What should the helpdesk check first?
Source: Intune helpdesk troubleshooting dashboard.
Device queries with KQL
Device query (part of Advanced Analytics / Intune Suite) lets you run real-time queries against enrolled devices using KQL (Kusto Query Language):
Example queries
| Query Purpose | KQL Example |
|---|---|
| List installed apps | InstalledApplications |
| Find a specific app | InstalledApplications | where Name contains "Zoom" |
| Check disk space | DiskDrive |
| List running services | Services | where State == "Running" |
| Check OS version | DeviceInfo |
How it works
- Intune admin center → Devices → select a device → Device query
- Type a KQL query
- Query runs in real-time against the device (via Intune management extension)
- Results return immediately — not from cached inventory
Key exam concept: Device queries return live data, not cached inventory. This makes them a powerful troubleshooting tool — you can check what’s installed, running, or configured right now without waiting for the next inventory sync.
Deep dive: KQL basics for Intune
You don’t need to be a KQL expert for the exam, but know the basics:
- Tables —
InstalledApplications,Services,DiskDrive,DeviceInfo,Registry - Filters —
| where Name contains "value"or| where State == "Running" - Projection —
| project Name, Version, Publisher(select specific columns) - Sorting —
| sort by Name asc
Example: “Find all devices with Chrome version less than 120”:
InstalledApplications | where Name contains "Chrome" | where Version < "120"The exam tests whether you know device query exists and what it can do — not complex KQL syntax.
🎬 Video walkthrough
Flashcards
Knowledge Check
A designer at Pixel & Co leaves the company. They used a personal iPhone with a work profile (Entra Registered, app protection policies). Riko needs to remove all company data but preserve the designer's personal photos and apps. What remote action should Riko use?
Sam needs to verify that a specific security patch is installed on a device right now — not what inventory reported yesterday. What should Sam use?
Next up: App Deployment: Prepare & Package — understanding app types, packaging Win32 apps, and preparing for Intune deployment.