Remote Actions & Device Queries
From your desk, you can sync, restart, wipe, or retire any managed device. Plus: run real-time KQL queries to investigate device issues without waiting for inventory sync.
Remote actions overview
Think of remote actions like a building manager’s control panel.
From one screen, you can lock any door, turn off any light, reset any alarm, or — in extreme cases — evacuate a floor. You don’t need to physically walk to each room. Intune’s remote actions give you the same power over managed devices: sync policies, restart a frozen laptop, wipe a stolen phone, or retire an old device — all from the Intune admin center.
The remote actions you need to know
| Feature | Sync | Restart | Retire | Wipe |
|---|---|---|---|---|
| What it does | Forces policy/app check-in | Reboots the device | Removes company data only | Factory resets the entire device |
| User data preserved | Yes | Yes | Personal data stays | No — everything deleted |
| Company data preserved | Yes | Yes | Removed | Removed |
| Device stays enrolled | Yes | Yes | No — unenrolled | No — unenrolled |
| Use case | Force a policy to apply NOW | Fix a frozen device | Employee leaves — clean corporate data | Device stolen — nuke everything |
| Reversible | Yes | Yes | No | No |
| Destructiveness | None | Low (just a reboot) | Medium (company data gone) | High (everything gone) |
When Riko uses each action at Pixel & Co
| Scenario | Action | Why |
|---|---|---|
| Designer says “my new app isn’t showing up” | Sync | Forces the device to check in and download pending apps/policies |
| Designer’s Mac is frozen and they’re remote | Restart | Reboots without needing the designer to hold the power button |
| Designer leaves the company (personal iPhone with work profile) | Retire | Removes company email, apps, and data — personal photos stay |
| Company iPad stolen from the office | Wipe | Factory reset — all data destroyed, device returns to OOBE |
| Intern’s laptop has malware | Wipe | Clean slate — reimaging is safer than trying to clean the infection |
Bulk remote actions
For large-scale operations, Intune supports bulk actions:
- Intune admin center → Devices → All devices → Bulk device actions
- Select the action (restart, sync, retire, wipe, etc.)
- Select the target OS platform
- Choose devices (by filter, group, or manual selection)
- Confirm and execute
Example: Sam at Tui Solutions runs a bulk sync on all 500 Windows devices after deploying a critical security policy — ensuring every device picks it up within minutes.
Defender Antivirus security intelligence updates
You can force Microsoft Defender Antivirus to update its virus definitions immediately:
- Select the device in Intune admin center
- Remote action → Update Windows Defender security intelligence
- Device downloads the latest threat definitions from Microsoft
When to use: After a zero-day threat announcement — don’t wait for the scheduled update. Force all devices to get the latest definitions immediately.
BitLocker recovery key rotation
BitLocker encrypts the drive, and the recovery key is the “emergency key” that unlocks it if the normal method fails. Intune can:
- Store BitLocker recovery keys in Entra ID (automatic during encryption)
- View recovery keys in the Intune admin center (Devices → select device → Recovery keys)
- Rotate the recovery key after it’s been used or viewed
Key rotation: After a recovery key is used (e.g., helpdesk unlocked a device), the key should be rotated so the old key no longer works. Intune can do this automatically or via remote action.
Exam tip: retire vs wipe
This is one of the most commonly tested distinctions:
- Retire = company data only. Personal data survives. Device unenrolls from Intune. Use when an employee leaves or a personal device needs corporate cleanup.
- Wipe = everything. Factory reset. All data destroyed. Use for stolen/lost devices or devices being repurposed.
If the exam says “employee’s personal phone” + “they’re leaving the company” → Retire (don’t wipe their personal photos). If the exam says “corporate laptop stolen” → Wipe (destroy everything).
Device queries with KQL
Device query (part of Advanced Analytics / Intune Suite) lets you run real-time queries against enrolled devices using KQL (Kusto Query Language):
Example queries
| Query Purpose | KQL Example |
|---|---|
| List installed apps | InstalledApplications |
| Find a specific app | InstalledApplications | where Name contains "Zoom" |
| Check disk space | DiskDrive |
| List running services | Services | where State == "Running" |
| Check OS version | DeviceInfo |
How it works
- Intune admin center → Devices → select a device → Device query
- Type a KQL query
- Query runs in real-time against the device (via Intune management extension)
- Results return immediately — not from cached inventory
Key exam concept: Device queries return live data, not cached inventory. This makes them a powerful troubleshooting tool — you can check what’s installed, running, or configured right now without waiting for the next inventory sync.
Deep dive: KQL basics for Intune
You don’t need to be a KQL expert for the exam, but know the basics:
- Tables —
InstalledApplications,Services,DiskDrive,DeviceInfo,Registry - Filters —
| where Name contains "value"or| where State == "Running" - Projection —
| project Name, Version, Publisher(select specific columns) - Sorting —
| sort by Name asc
Example: “Find all devices with Chrome version less than 120”:
InstalledApplications | where Name contains "Chrome" | where Version < "120"The exam tests whether you know device query exists and what it can do — not complex KQL syntax.
🎬 Video walkthrough
🎬 Video coming soon
Remote Actions & Device Queries — MD-102 Module 17
Remote Actions & Device Queries — MD-102 Module 17
~11 minFlashcards
Knowledge Check
A designer at Pixel & Co leaves the company. They used a personal iPhone with a work profile (Entra Registered, app protection policies). Riko needs to remove all company data but preserve the designer's personal photos and apps. What remote action should Riko use?
Sam needs to verify that a specific security patch is installed on a device right now — not what inventory reported yesterday. What should Sam use?
Next up: App Deployment: Prepare & Package — understanding app types, packaging Win32 apps, and preparing for Intune deployment.