Skip to content 
Microsoft Intune
In many companies, notebooks and smartphones are now managed via Microsoft Intune. That is practical in everyday use – and important when saying goodbye to a device. Because anyone who does not correctly remove it from Intune and Autopilot before selling passes it on with a company binding.
In brief
Microsoft Intune is a cloud service from Microsoft for Mobile Device Management (MDM) and Mobile Application Management (MAM), with which companies centrally set up, secure and manage Windows PCs, Macs, smartphones and tablets. Intune controls policies, apps, encryption and remote actions such as resetting. Before decommissioning, a device must be properly signed off there so that it does not remain bound to the company tenant.
What does Microsoft Intune do?
Intune is included in several Microsoft 365 license packages, is also available separately and works closely with Microsoft Entra ID, formerly Azure Active Directory. A device registered in Intune automatically receives the company's specifications: password rules, BitLocker encryption, Wi-Fi profiles, apps and updates.
Intune covers two areas. With Mobile Device Management (MDM) the company manages the entire device. With Mobile Application Management (MAM) it manages only the company apps and their data, for example on private smartphones.
Remote actions and what they mean
| Action in Intune | What happens | Suitable for |
|---|---|---|
| Reset (Wipe) | Resets the device to factory settings and removes company and user data | Company devices before handover or in case of loss |
| Detach (Retire) | Removes only company data, apps and profiles; personal data remains | Private devices (BYOD) |
| Delete | Removes the device entry from the Intune console | Cleaning up after the reset |
| Autopilot Reset | Resets a Windows device for a new user in the same company | Passing on internally, not sale |
Important: an Intune wipe is a remote action without an erasure certificate per data carrier. It resets the device but does not replace a demonstrable erasure with a report.
What to note when retiring devices
- Back up data and reset the device: Back up user data, then reset the device or hand it to a service provider for certified erasure.
- Remove from Intune and Entra ID: Delete the device entry so that no policies apply anymore.
- Remove Autopilot registration: Windows devices that are registered via Windows Autopilot will otherwise sign back in to your company at the next setup. For the buyer, the device is then practically unusable.
- Note the BitLocker key: If an encrypted drive is handed over without erasure, the protection depends on the key. Details in the entry BitLocker.
The order of steps when employees leave is shown by our offboarding checklist.
Rule of thumb: first reset, then sign out of Intune and Autopilot – otherwise the device still belongs to your company after the sale.
Intune devices and Second IT
Second IT erases notebooks, PCs and mobile devices with Blancco, including hidden areas such as HPA and DCO, and issues a digitally signed erasure certificate for each device. This gives you proof that a remote action alone does not provide. More on certified data deletion.
Frequently asked questions about Microsoft Intune
What is the difference between Wipe and Retire in Intune?
Wipe resets the entire device to factory settings. Retire removes only the company data and management profiles and leaves personal content untouched. For company devices before a sale, Retire is not sufficient.
Is an Intune wipe enough before selling?
Technically it resets the device. As proof for the GDPR, however, a report per data carrier is missing. In addition, the device must be removed from Intune, Entra ID and, where applicable, Autopilot.
Why does a sold notebook sign in to the old company?
Usually it is still registered in the old company's Windows Autopilot service. During setup, Windows recognizes the registration and redirects to the company sign-in. Only the old owner removing the registration provides a remedy.
What is Windows Autopilot?
Windows Autopilot is a Microsoft service that automatically sets up Windows devices with the company settings at first startup. If a device is registered there, Windows redirects to the company sign-in during setup. The registration must therefore be removed before sale.
What is the difference between MDM and MAM in Intune?
With Mobile Device Management (MDM), the company manages the entire device. With Mobile Application Management (MAM), it controls only the company apps and their data. MAM is suitable, for example, for private smartphones on which only company data is to be protected.
Decommission managed devices securely – with a certificate per device.
Send us your device list. You will receive your offer in 48 hours on average.