Full Wipe vs Selective Wipe in Intune: What IT Admins Need to Know

An employee’s phone goes missing.
It has company email, files, and apps on it.

Do you erase the entire device, or just remove company data?

This is where Microsoft Intune wipe actions come into play. Intune gives IT admins two powerful options: full wipe and selective wipe.

Choosing the wrong one can mean lost personal data, unhappy users, or worse, exposed corporate information.

With more BYOD and remote work, IT teams manage both corporate and personal devices every day. This makes understanding the difference between full wipe and selective wipe in Intune essential for balancing data security and user privacy.

In this guide, we’ll clearly explain full wipe vs selective wipe Intune, compare how each action works, and show when to use them in real scenarios.

You’ll also learn best practices so you can apply the right Intune wipe action with confidence.

Before comparing options, it helps to understand what each Intune wipe action actually does. While both aim to protect company data, their impact on the device is very different.

A full device wipe in Intune completely resets the device.
Once started, the data cannot be recovered, so use this carefully.

A selective wipe in Intune removes only company data.
Personal files and apps remain untouched.

This method applies when the device is not enrolled in Intune.

Choosing between a full wipe and a selective wipe depends on the situation.
Here are common IT scenarios and the best Intune wipe action for each.

Using Intune wipe actions correctly is about policy, process, and discipline.
Below are key best practices, explained with clear points and subpoints.

1. Separate corporate and personal data

• • Use App Protection Policies (MAM) for BYOD devices
    • Enables selective wipe in Microsoft Intune
    • Allows removal of company data without touching personal apps or files

2. Maintain a clear BYOD policy

• • Clearly document what a selective wipe does
    • Corporate apps and data can be removed remotely
    • Personal data is not affected
  • Communicate this policy during onboarding to set expectations early

3. Use the least disruptive wipe action first

• • Prefer selective wipe for:
    • Personal devices
    • Minor security or compliance issues
  • Escalate to full wipe only when required
    • Lost or stolen corporate devices
    • Device decommissioning

4. Train IT admins and support teams

• • Ensure teams understand:
    • Wipe vs retire vs delete
    • Enrollment retention options during a full wipe
  • Test wipe actions on non-production devices to avoid mistakes

5. Plan for offline and high-risk scenarios

• • Remember that wipes occur only when devices check in
  • For urgent incidents:
    • Disable or block the user account
    • Revoke access tokens
    • Use wipe as part of a broader incident response plan

6. Monitor and verify wipe actions

• • Always confirm wipe or retire completion in Intune
    • Review Audit Logs for success or failure
  • If a wipe is pending:
    • Ensure the device is online
    • Document the risk if the device never reconnects

7. Leverage compliance and Conditional Access policies

• • Use compliance rules to reduce manual wipe needs
    • Block access for non-compliant devices
    • Automatically remove corporate email profiles
  • This limits exposure even before a wipe is triggered

8. Protect wipe actions with admin approvals

• • Enable approval workflows for remote wipes if available
    • Reduces risk of accidental or malicious full wipes
    • Especially useful for bulk or high-impact actions

9. Keep Intune inventory clean

• • Delete stale or retired device records
  • Avoid confusion caused by reused device names or recycled hardware

Microsoft Solutions Partner Advantage

As a certified Microsoft Solutions Partner, we combine official Microsoft guidance with real-world Intune experience to deliver reliable, enterprise-ready device management for organizations of any size.

Microsoft Intune Specialists

We design and implement secure device management strategies using Microsoft Intune, helping organizations manage full wipes, selective wipes, and device lifecycle actions across Windows, iOS, and Android.

Our focus is ensuring corporate data is protected without disrupting users or violating BYOD privacy expectations.

Certified and Experienced Team

Our consultants hold advanced Microsoft certifications and bring hands-on experience with Microsoft Intune, Endpoint Manager, and Microsoft Entra ID.

We work daily with:

• Full device wipe and selective wipe actions
• Retire vs wipe vs delete decisions
• App Protection Policies for BYOD
• Compliance and Conditional Access integration

End-to-End Device Protection Strategy

We help organizations build a complete Intune strategy, covering:

• Device enrollment and governance
• BYOD policy design
• Secure offboarding workflows
• Lost and stolen device response
• Ongoing compliance enforcement

This ensures wipe actions are part of a clear, repeatable process.

Seamless Deployment and Tuning

From assessment to rollout, we guide you through every step:

• Configuring Intune policies correctly
• Testing wipe and retire actions safely
• Reducing accidental full wipes
• Optimizing settings for different device ownership models

Our goal is reliable device management with minimal operational risk.

Compliance-Focused Device Management

Our approach aligns with ISO, SOC 2, HIPAA, and GDPR requirements by enforcing:

• Controlled data removal
• Logged and auditable wipe actions
• Strong identity and access controls

This supports secure and compliant device offboarding and incident response.

Continuous Monitoring and Improvement

We don’t just set up Intune and walk away.
We help you review wipe activity, analyze trends, and adjust policies as device usage and risks evolve.

This keeps your Intune environment secure over time.

Strengthen your Microsoft Intune environment with clear, secure device wipe and management practices.
Schedule a consultation and let our team help you build a safe, predictable Intune device strategy.

Q1. What is a selective wipe in Microsoft Intune?

A selective wipe in Microsoft Intune removes only company data from a device.
It deletes corporate apps, work email, and managed settings, while leaving personal data untouched.

This is commonly done using the Retire action or App Protection Policies.

Q2. What happens when you full wipe a device in Intune?

A full wipe performs a remote factory reset.
All data is erased, including corporate and personal files, apps, and settings.

After the wipe, the device returns to its initial setup screen.

Q3. Does a selective wipe remove personal data?

No.
A selective wipe removes only corporate data. Personal photos, apps, messages, and files remain on the device.

This is why selective wipe is preferred for BYOD devices.

Q4. Can Intune wipe only corporate apps and data, not the whole device?

Yes.
That is exactly what a selective wipe does.

It removes company apps and data only, without resetting the entire device.

Q5. How do I choose between retire, wipe, or delete in Intune?

• Retire
  • Removes corporate data only
  • Used for BYOD or employee offboarding
• Wipe
  • Fully resets the device
  • Used for lost, stolen, or corporate-owned devices
• Delete
  • Removes the device record from Intune
  • Does not wipe data from the device

This Intune wipe vs retire vs delete distinction helps avoid accidental data loss.

Q6. Will a device restart automatically after a full wipe?

Yes, in most cases.
A full wipe triggers an automatic restart as part of the reset process.

Phones reboot into factory reset mode, and Windows devices restart and begin resetting automatically.

Q7. What if an Intune wipe command doesn’t work?

If a wipe is not completing:

• Check that the device is powered on and connected to the internet
• Remember that wipe commands stay pending until the device checks in
• If the device was already reset or unenrolled, Intune may not be able to reach it

As a backup, rely on encryption, account blocking, or access revocation to protect data.

Q8. Does the user get notified when a device is wiped?

Intune does not send a formal notification email.
However, users will notice changes, such as apps being removed, sign-outs, or the device restarting during a full wipe.