Offboarding Devices in Intune — Retire vs. Wipe vs. Delete, and Why the Order Matters

Summary:

Microsoft Intune provides three different ways to remove a device—Retire, Wipe, and Delete—and they are not interchangeable. Choosing the wrong option can leave corporate data on a personal device or trigger a factory reset when you only intended to remove management. This guide explains how Intune device management handles each action and the correct offboarding sequence for secure endpoint management and device lifecycle management.

Device offboarding looks like a one-click task until you open the Microsoft Intune action menu and see three options that all appear to remove a device: Retire, Wipe, and Delete. They behave very differently, and choosing the wrong one can either leave corporate data exposed or wipe a device that was never meant to be reset. Understanding these actions before processing an employee departure or responding to a lost-device incident helps create a reliable Intune offboarding process.

Retire is the action you want for most offboarding scenarios, especially in BYOD device management environments. It removes only the company footprint—the Intune management profile, security policies, and corporate data—while leaving personal apps, photos, and accounts untouched. For a personal phone enrolled through Microsoft Intune, Retire is the correct approach because it protects business information without affecting the employee’s personal content. This is a key best practice in mobile device management (MDM).

Wipe is the heavier option. It performs a full factory reset, erasing everything on the device and returning it to an out-of-box state. This action is appropriate for corporate-owned devices that will be reassigned, as well as lost or stolen devices where organizational data may be at risk. For corporate device management, Wipe helps maintain strong endpoint security by ensuring sensitive information is removed completely. However, using a Wipe action on a personal BYOD device would erase personal data along with company information, making it unsuitable for most employee-owned devices.

Delete is the option that often creates confusion in Microsoft Intune management. Deleting a device record only removes it from the Intune admin center; it does not remove management, policies, or company data from the actual device. If administrators choose Delete Device from Intune before a Retire or Wipe action has been processed, the device can become orphaned. The device disappears from the console but may still contain corporate data and active management profiles. In other words, Delete is a cleanup action, not a device removal action.

A safe offboarding order

• Identify the ownership type first—personal (BYOD) or corporate-owned—because it determines whether you should use Intune Retire Device or Intune Wipe Device.
• For BYOD devices, run Retire to remove the company profile, policies, and corporate data while preserving the user’s personal information.
• For corporate-owned, lost, or stolen devices, run Wipe to perform a complete factory reset and protect organizational data.
• Confirm that the device has checked in and that the action completed successfully. Both Retire and Wipe require the device to be online before the requested action can be processed.
• Only after the action has completed should you Delete Device from Intune to remove the stale record from the console. Delete should always be the final cleanup step.

The most common mistake in Intune device lifecycle management is performing the actions in the wrong order. Deleting a device record before Retire or Wipe has completed can leave a managed device containing corporate data without any practical way to remove it remotely. Another common issue is assuming that Retire or Wipe happens immediately. If the device is offline, the action remains queued until the next check-in, making verification an essential part of the Intune offboarding process.

The takeaway is simple: match the action to the device and follow the correct sequence. Use Retire for personal devices, Wipe for corporate-owned or compromised devices, and Delete only after the removal process has been completed. By incorporating these steps into your device lifecycle management and endpoint management procedures, organizations can securely remove corporate data, respect employee privacy, and maintain a clean Microsoft Intune environment every time.