Devices

Manage Intune devices across your Microsoft 365 tenants.

The Devices page lists the devices managed by Intune in the selected tenant, and is where most day-to-day device management is carried out. From here you can sync, rename, reboot, and locate devices, retrieve recovery keys, local admin passwords and BIOS passwords, run Defender scans, offboard devices from Defender for Endpoint, reset or wipe a device, add devices to groups, and remove devices from management. Which actions are available for a given device depends on its operating system.

Action Buttons

Sync DEP

Synchronises the tenant's Apple Device Enrollment Program tokens, bringing in newly purchased devices. The sync runs in the background and can take several minutes, and can only be started once every 15 minutes.

Table Details

The properties returned are for the Graph resource type managedDevice. For more information on the properties please see the Graph documentation.

Selecting a row opens a flyout showing the device name and its assigned user.

Table Actions

Bulk Action Available

Action	Description	Bulk Action Available
View Device	Opens the device's View Device page in CIPP, with its full details, applications, and users.
View in Intune	Opens the device in the Microsoft Intune admin center in a new tab.
Change Primary User	Sets a different user as the device's primary user.
Add to Group	Adds the device to one or more Entra ID groups. Groups are listed with their name and type, and several can be selected at once, with the device added to each. Devices cannot be added to Distribution List or Mail-Enabled Security groups, and selecting one returns an error for that group rather than failing the whole action.
Rename Device	Changes the device's name to one you specify.
Sync Device	Asks the device to check in with Intune, so that pending policies and applications are applied sooner than the next scheduled sync.
Reboot Device	Restarts the device.
Locate Device	Requests the device's current location.
Retrieve LAPS password	Retrieves the local administrator password held for the device. On Windows this is the Windows LAPS password. On macOS it is the password Intune set for the local admin account at Automated Device Enrollment, which only exists where the enrolment profile creates that account, otherwise the action reports that none was found. Windows and macOS devices.
Rotate Local Admin Password	Forces the local administrator password to be changed and a new one stored. Windows devices only.
Retrieve BIOS Password	Retrieves the BIOS password Intune holds for the device. A password only exists where the device is targeted by a BIOS configuration profile that manages per-device passwords, otherwise the action reports that none was found. Windows devices only.
Retrieve BitLocker Keys	Retrieves the BitLocker recovery keys escrowed for the device. Windows devices only.
Retrieve FileVault Key	Retrieves the FileVault recovery key escrowed for the device. macOS devices only.
Reset Passcode	Resets the device's passcode. Android devices only.
Remove Passcode	Removes the device's passcode. iOS devices only.
Windows Defender Full Scan	Starts a full Microsoft Defender scan on the device.
Windows Defender Quick Scan	Starts a quick Microsoft Defender scan on the device.
Update Windows Defender	Updates the Microsoft Defender signatures on the device.
Offboard from Defender for Endpoint	Offboards the device from Microsoft Defender for Endpoint, so that it stops reporting to Defender. The device is matched to its Defender record by its Entra ID device ID, and every matching record that is still onboarded is offboarded. Where the device has no Entra ID device ID, or has no matching Defender record that is currently onboarded, the action reports an error and nothing is offboarded. Offboarding cannot be undone from CIPP, and the device has to be re-onboarded to return it to Defender. Windows devices only.
Fresh Start	Reinstalls Windows on the device, asking whether to keep or remove the user's data. Windows devices only.
Wipe Device	Erases all content and settings on the device, which cannot be undone. Asks whether to keep or remove enrolment data: keeping it re-provisions the device through Autopilot, and removing it retires the device fully. Also asks whether to use a standard or protected wipe, where a protected wipe resumes if interrupted but may leave the device unbootable if it fails. Windows devices only.
Wipe Device	Erases all content and settings on the device, which cannot be undone. A Recovery PIN (optional, 6 digits) can be supplied, and is needed to unlock Intel Macs that have no T2 security chip once the wipe has finished. macOS devices only.
Autopilot Reset	Wipes the device, keeping its enrolment data, and re-provisions it through Windows Autopilot. Windows devices only.
Delete Device	Deletes the device record from Intune.
Retire device	Removes company data and management from the device while leaving the user's personal data in place.
More Info	Opens the Extended Info flyout with the full details for the selected row.

---

Feature Requests / Ideas

We value your feedback and ideas. Please raise any feature requests on GitHub.