Intune Wipe vs Retire vs Fresh Start vs Autopilot Reset: Which to Use

Wipe factory-resets a device and removes everything on it, company and personal. Retire removes only what Intune put there, such as company apps, email profiles and Wi-Fi settings, and unenrolls the device while leaving personal data, which makes it the action for personal phones. Fresh Start strips apps from a Windows PC and can keep the user's files, and Autopilot Reset returns an Entra joined Windows PC to a ready-for-the-next-user state while keeping it enrolled.

Picking the wrong one is how a business turns a reusable laptop into a full rebuild, or leaves company email on a former employee's phone. This guide explains what each action removes and keeps, compares them in pairs, and gives a rule for each common situation, based on Microsoft's Intune documentation as of October 2026. Our Intune management service handles these actions for clients as people join, move and leave.

Summarized from Microsoft Learn's pages on Wipe, Retire, Fresh Start and Autopilot Reset, checked October 2026.

What does an Intune wipe do?

Wipe restores a device to factory settings, removing personal and company data, apps and configuration. Microsoft positions it for devices being retired, repurposed or reset for troubleshooting, and for devices that are lost or stolen. On Windows, three variations matter:

• Keep enrollment state and associated user account. Resets Windows but preserves user data and accounts; Intune policies are removed and the device stays enrolled. Useful for repairing a broken Windows install, not for a departing employee.
• Continue to wipe even if the device loses power. Deletes everything and overwrites free space so data can't be recovered. Microsoft warns it can leave some devices unable to start again, so use it only on company-owned devices where full destruction is the goal, such as a stolen laptop.
• No option selected. A standard factory reset that tries to roll back if it's interrupted.

On iPhones and iPads, a wipe keeps the eSIM data plan by default unless you choose to remove it. Older Macs without a T2 chip need a six-digit recovery PIN, which you must record before sending the wipe. And after wiping a device you're getting rid of, deregister it from Windows Autopilot and remove its stale Entra ID record, as Microsoft's wipe guide recommends.

What does Retire do?

Retire removes company data without a factory reset. Microsoft calls it "ideal for personally owned devices or when transitioning a device out of organizational control": it unenrolls the device from Intune and removes the managed apps, settings and profiles Intune deployed, while personal data stays. The action runs the next time the device checks in, so an offline phone keeps company data until it reconnects.

Exactly what goes depends on the platform. On an iPhone, Intune removes the management profile, Wi-Fi and VPN profiles, certificates and Intune-provisioned email, and selectively wipes work data from Outlook and other Microsoft apps covered by app protection policies. On Windows, Intune uninstalls the apps it deployed and disconnects the device from Entra ID, though Microsoft 365 Apps and Win32 apps installed through the Intune management extension stay installed.

One Windows trap: retiring an Entra joined laptop protected by BitLocker removes its key protectors and suspends BitLocker, and afterward nobody can sign in with an Entra account. Microsoft says to back up the BitLocker recovery key and local administrator credentials before you retire one.

What does Fresh Start do?

Fresh Start is a Windows-only action that removes apps, including the preinstalled apps that ship on many new PCs. The key choice is Retain user data on this device. Selected, the PC stays Entra joined, keeps the contents of the user's Home folder, loses its apps and settings, and re-enrolls in Intune when an Entra user signs in. Not selected, Windows returns to the end of first-time setup, keeping the built-in administrator account, and a personally owned PC is removed from Entra ID and Intune.

Use it to clean up a new PC that arrived with trial software, or to clear a cluttered PC for the same user. Because apps are removed, confirm the user's business apps are assigned in Intune before you start, so they come back after the device re-enrolls.

What does Autopilot Reset do?

Autopilot Reset prepares a Windows PC for its next user without a full rebuild. Microsoft says it removes personal files, apps and settings, reapplies the device's original settings, and keeps the device's Entra ID join and Intune enrollment, along with Wi-Fi details, provisioning packages and SCEP certificates. The user can't reach the desktop until those are restored and, for Intune devices, until a sync completes.

There are two ways to run it. A remote reset starts from the Intune admin center, needs the Intune Service Administrator role, and clears the device's primary user so the next person to sign in becomes the owner. A local reset starts at the lock screen with Ctrl, the Windows key and R, once a policy allows it and an administrator signs in. Either way the Windows Recovery Environment must be enabled, and Entra hybrid joined devices aren't supported; for those, Microsoft says a full wipe is required.

Intune wipe vs Fresh Start: which one for a Windows PC?

Ask what should be left when it finishes. Wipe leaves nothing, so it's the right call when the device is lost, stolen or leaving the company, or when Windows itself is broken. Fresh Start leaves Windows, the Entra ID join and, if you choose, the user's files, so it's the right call when the same person keeps the PC and only the apps need clearing. If the PC is going to someone else, neither is ideal; that's the job Autopilot Reset was built for.

Fresh Start vs Autopilot Reset: what's the difference?

Both keep a Windows PC joined and managed, but they serve different people. Fresh Start is for the current user: it removes apps and can keep their files. Autopilot Reset is for the next user: it removes the previous person's files, apps and settings, reapplies the original configuration and, run remotely, resets the primary user. Autopilot Reset also doesn't support hybrid joined devices, and the remote version needs an Entra joined device, while Fresh Start's documentation lists only Windows as a platform requirement.

Retire vs wipe: which one when someone leaves?

It depends on who owns the device. A personal phone gets Retire or, if it was never enrolled and only had app protection policies, a selective wipe of the work apps, which removes company data without touching personal content. A company laptop coming back for reuse gets Autopilot Reset if it's an Entra joined PC, or Wipe otherwise. A company device that isn't coming back, because it's lost or the person kept it, gets Wipe, with the power-loss option where the data is sensitive. Our IT offboarding checklist covers the account side of a departure.

Which fits a small team?

• Lost or stolen laptop: Wipe, with the continue-if-power-is-lost option when the data is sensitive.
• Employee leaves with a personal phone: Retire, or a selective wipe of the work apps if the phone was never enrolled.
• Laptop goes to a new hire: Autopilot Reset for Entra joined PCs; Wipe for hybrid joined PCs, which Autopilot Reset doesn't support.
• New PC loaded with preinstalled software: Fresh Start, keeping user data if someone already works on it.
• Broken Windows install, same user: Wipe with Keep enrollment state and associated user account.
• Device being sold, recycled or returned to a lessor: Wipe, then remove it from Autopilot, Apple Business where it applies, and Entra ID before it leaves.

What affects cost and support?

Microsoft's pages for these actions list platform and administrator role requirements, not an extra license, so the license that matters is Intune itself. As of October 2026, Intune Plan 1 is included in Microsoft 365 Business Premium at $22.00 per user per month and costs $8.00 per user per month on its own, according to Microsoft's Intune pricing page.

The real cost is the time around the click: recovering keys and credentials before a retire, shipping devices, reinstalling apps after a Fresh Start, and rescuing a PC whose reset failed because the recovery environment was turned off. A written rule for each situation, like the list above, keeps that time small.

How does NetSys help?

Device actions are part of running Intune for clients: devices are reassigned or retired when people join, change roles or leave, and lost or returned phones and tablets get the retire or wipe action that matches who owns them. Our deployments include encryption and recovery-key settings, so a BitLocker recovery key is on record before a retire or reset. For hardware leaving the business for good, our IT asset disposition service wipes or destroys each drive to NIST SP 800-88 and issues a certificate for every job.

Book a call with a NetSys engineer to set up a device process your office manager can follow, with the right action for each situation in your Intune tenant.

Frequently asked questions

Does an Intune wipe remove the device from Autopilot?

No. The Windows Autopilot registration stays until you remove it, and Microsoft's wipe guide suggests deregistering a device you're disposing of and cleaning up its Entra ID record too. Leave the registration in place if the device will be reused, so it goes through Autopilot setup again for the next person.

Does Retire delete the Entra ID device record?

It depends on the platform. On Windows, Retire removes the record for Entra joined and Entra registered devices, but not for devices registered in Autopilot. On iPhones, iPads and Macs the record stays, so clean it up separately.

What happens if a device is offline when I send Retire?

Nothing, until it checks in. Microsoft says Retire runs the next time the device connects to Intune, and the device may still appear in the admin center until then. To cut off access in the meantime, disable the user's account and rely on Conditional Access.

Can I use Autopilot Reset on a hybrid joined PC?

No. Microsoft says Autopilot Reset doesn't support Microsoft Entra hybrid joined devices, which need a full wipe instead, and that a hybrid device can take up to 24 hours to be ready for deployment again after a full reset.

Will Fresh Start keep the user's files?

Only if you select Retain user data on this device. That keeps the contents of the user's Home folder and the Entra ID join while removing apps and settings. Without it, Windows returns to the end of first-time setup, keeping the built-in administrator account, so plan to restore the user's files from OneDrive or a backup.