# Managing Device Lifecycle and Retirement

> Chapter 8 of the Courseiva MD-102 curriculum — https://courseiva.com/learn/md-102/managing-device-lifecycle-and-retirement

**Official objective:** 2.3 — Manage device lifecycle, including retirement and decommissioning

## Introduction

Exam objective 2.3 — Manage device lifecycle, including retirement and decommissioning — is the part of the MD-102 exam that deals with what happens to a device from the moment it is issued to a user until the moment it is securely disposed of. It matters because an unretired device is a massive security risk: if a laptop is simply thrown away without wiping company data, the next owner can read every email, access every file, and log into every corporate app the previous user had access to.

## The Moving Out of a Rental Flat Analogy

Have you ever moved out of a rental flat and worried you would get your full deposit back?

The process of managing a device’s lifecycle in an organisation is surprisingly similar. When you move into a new flat, you sign a lease, get the keys, and set up your furniture — that is the 'provisioning' phase. You live there, pay rent, and fix the odd leak — that is 'management.' But what happens when you decide to leave? You do not just walk out with your suitcase. You clean every room, patch the holes in the walls, return the keys to the landlord, and cancel the utility accounts. If you skip a step — say, you forget to cancel the electricity — you could be charged for months of power you never used.

Now map this to corporate devices. A laptop is like the flat. The company owns the flat; you are just the tenant. When you leave the company (or the laptop gets too old), the IT team must 'move out' properly. They wipe the hard drive (deep clean the flat), remove the laptop from Microsoft Entra ID (return the keys to the landlord), and revoke the user’s access to company data (cancel the utility accounts). If they skip the wipe, sensitive files could end up in a stranger’s hands — like leaving a diary full of secrets in the flat for the next tenant. That is exactly what device lifecycle and retirement prevents: a clean, secure handover every time.

## Core explanation

Device lifecycle management is the complete journey a device takes inside an organisation. Think of it like a product’s life in a factory: raw materials come in, are assembled, used for a while, and eventually recycled or disposed of when they no longer serve a purpose. In IT, a device — usually a laptop, desktop, tablet, or phone — goes through four main phases: enrolment, configuration, management, and retirement.

Let us start at the beginning. Enrolment is when a device is first registered with the organisation’s management system. For Microsoft shops, that system is Microsoft Intune, which is part of the Microsoft Endpoint Manager family. When a new laptop is unboxed, the IT team does not just hand it over; they enrol it into Intune. Enrolment creates a link between the device and the organisation’s policies. This is the 'lease signing' moment.

Configuration follows. Once enrolled, the device receives a set of settings — these are called 'configuration profiles.' A configuration profile says things like: the screen must lock after 5 minutes, the password must be at least 8 characters, and the device must automatically install updates. This step ensures every laptop in the company looks and behaves the same way.

Management is the longest phase. During management, IT monitors the device for health and compliance. They check if the device has the latest security updates, if the antivirus is running, and if the user has installed any unauthorised software. Management is about keeping the device safe and productive while the user is working.

Finally, we reach retirement. Retirement is the deliberate process of removing a device from the organisation’s control. This is not the same as the device breaking or a user simply logging off for the last time. Retirement is an intentional, tracked action. In Intune, an administrator will retire a device when:

- The user leaves the company
- The device is being replaced with a new model
- The device is lost or stolen
- The device has reached its end-of-life, meaning the manufacturer no longer supports it with security updates


When a device is retired, Intune performs a 'factory reset' — it wipes all data and settings, returning the device to its out-of-box state. Then Intune removes the device from its management list. The device is no longer enrolled, and it can no longer access company resources like email, SharePoint, or Microsoft Teams.

Decommissioning is a more thorough version of retirement. It includes physically destroying the storage drive or securely erasing it multiple times so that no forensic tool can recover data. Decommissioning is typically used for devices that contained highly sensitive data, such as a CEO’s laptop or a server hard drive.

Why does all of this matter for MD-102? The exam tests whether you understand the difference between retiring and wiping, and when to use each. It also tests the sequence of these actions. For example, if a laptop is stolen, the correct order is: first, remotely wipe it; second, retire it in Intune. If you retire first without wiping, Intune might lose the communication channel to the device, and the wipe command never reaches it. That is a classic exam trap.

In the old days, IT teams had to physically collect every old laptop, manually wipe the hard drive with a software tool, then reinstall the operating system. This process was slow and error-prone. Microsoft Intune automates the entire lifecycle. An administrator can retire 1000 devices from a single console in a few clicks. This saves hours of labour and eliminates human error.

## Real-world context

Let me walk you through what an IT professional named Priya does when she manages device retirement for her company, which has 500 employees.

Priya gets an email from HR: 'Priya, please prepare a replacement laptop for Sarah in Finance. Her current Dell Latitude is four years old and battery life is terrible.' Priya opens the Microsoft Intune admin centre. First, she checks Sarah’s current device status. It shows 'Compliant' and 'Active,' meaning it is healthy and still being managed.

Priya knows she must not retire the old laptop until Sarah has logged into the new one and confirmed her data is transferred. So she first provisions a new laptop — a process called 'Windows Autopilot' — which sets up the new device with all the right policies automatically. Sarah receives the new laptop, logs in, and her files sync from OneDrive.

Once Sarah confirms everything works, Priya performs the retirement. In the Intune console, she selects Sarah’s old device, clicks 'Retire,' and confirms the action. Immediately, Intune sends a command to the old laptop: wipe the hard drive, unenrol from Intune, and remove all configuration profiles. Sarah’s old laptop can no longer open Outlook or access the company’s VPN. The device becomes a blank slate. Sarah can donate it to a school, or Priya can recycle it through an approved e-waste vendor.

Now, here is where the real-world gets tricky. What if the laptop is lost? Priya cannot physically collect it. In that case, she uses a different action called 'Wipe' from the same console. The wipe action does a full factory reset, including the operating system, so that even if someone finds the laptop, they cannot boot it and get Sarah’s data. After the wipe, Priya also changes Sarah’s passwords and revokes any session tokens in Microsoft Entra ID. The combination of device wipe and account lockdown ensures no data leak.

Priya also handles 'decommissioning' for devices that held sensitive data, like laptops used by the legal team. For those, she does not just wipe; she marks them for 'physical destruction' in an inventory spreadsheet. A vendor picks up the drives, physically shreds them, and sends Priya a certificate of destruction. That certificate is important for compliance audits.

Finally, Priya maintains a device inventory report in Intune. She runs it monthly to find devices that have not checked in for 30 days — those are 'orphaned' devices. She contacts the users. If she gets no response, she retires and wipes those devices to keep the organisation clean.

## Exam focus

MD-102 tests 'Managing Device Lifecycle and Retirement' in a few specific ways. You must know the exact Intune actions and their consequences. Here is what the exam expects.

First, the exam asks you to choose between 'Retire' and 'Wipe.' The key difference: Retire removes the device from management and wipes corporate data only (like email profiles and apps), but leaves the personal data intact if the device is a 'BYOD' (bring-your-own-device) scenario. Wipe does a full factory reset, removing everything — both corporate and personal data. The exam gives you a scenario like: 'A user is leaving the company. The device is company-owned. What should you do?' The correct answer is Wipe because the device belongs to the company and all data must be removed. If the device is personally owned (BYOD), the correct answer is Retire, because wiping would destroy the user’s personal photos and files.

Second, the exam loves to test the order of operations. When a device is lost or stolen, you must first remotely wipe it, then retire it. If you retire first, the device might stop communicating with Intune, and the wipe command never arrives. This is a classic trap. Memorise: Wipe first, then Retire.

Third, the exam tests 'Windows Autopilot reset.' This is a feature that re-enrols a device to the same tenant after a wipe, making it ready for the next user without manual setup. Autopilot reset is not the same as a standard wipe. It is a 're-provisioning' tool. You would use Autopilot reset when you want to keep the device on the same tenant (company) but wipe it for a new employee.

Fourth, the exam tests what happens when a device is deleted from Microsoft Entra ID before it is retired. If an admin deletes the device object in Entra ID, Intune loses the communication link to that device. The device becomes 'orphaned' — it still has data on it, but it cannot be managed remotely anymore. The correct process is to always retire the device from Intune first.

Fifth, the exam tests 'compliance policies' related to retirement. A non-compliant device can be automatically retired by Intune if you set up a conditional access policy. For example, you can configure that any device with an outdated antivirus definition is automatically retired. This is a 'Conditional Access' rule combined with an Intune retirement action.

Here are the concepts you must memorise for the exam:

- Retire: removes management, wipes corporate data only (BYOD scenario)
- Wipe: factory reset, removes all data (company-owned device)
- Autopilot reset: wipes and re-enrols to the same tenant
- Orphaned device: a device whose management relationship was broken (e.g., admin deleted it in Entra ID)
- Certificate of destruction: proof that storage media was physically destroyed
- Conditional Access: a policy in Microsoft Entra ID that can block or retire devices based on compliance status


The exam also tests 'grace period' for retirement. You can set a 'retirement grace period' in Intune — this is the number of days a device can be non-compliant before it is automatically retired. The default is 30 days. You should know that this is configurable per policy.

Finally, the exam includes scenario-based multiple-choice questions where you must identify the correct sequence. For example: 'A device is lost. The user reports it. What three steps should the administrator take?' The answer: Remotely wipe, Then retire in Intune, Then reset the user’s password in Microsoft Entra ID.

## Step by step

1. **1. Initiate the Retirement Request** — The trigger comes from HR (employee leaving), the user (device upgrade), or security (lost/stolen). The administrator verifies the request against company policy before taking action.
2. **2. Back Up User Data** — Before wiping, ensure the user’s files are synced to OneDrive or another backup system. Use the 'collect diagnostics' feature in Intune to confirm data integrity if needed. This prevents accidental data loss.
3. **3. Perform the Wipe or Retire Action in Intune** — In the Microsoft Intune admin centre, select the device and choose 'Wipe' for company-owned devices or 'Retire' for BYOD devices. This sends the command over the internet to the device. The device must be online to receive it.
4. **4. Remove the Device Object from Microsoft Entra ID** — After the wipe/retire command is acknowledged, delete the device from Microsoft Entra ID entries. This ensures the device cannot authenticate to any cloud services even if the wipe somehow fails.
5. **5. Revoke User Access and Session Tokens** — In Microsoft Entra ID, revoke the user’s sign-in sessions and reset their password if the device was lost or stolen. This blocks the user (or a thief) from accessing company data from any other device using cached credentials.
6. **6. Update the Asset Inventory and Retention Log** — Mark the device as 'Retired' in the asset database. If the device was physically destroyed, attach the certificate of destruction. Update the compliance report to show the device is no longer managed. This is critical for audits.
7. **7. (Optional) Reprovision the Device for Reuse** — If the device is company-owned and in good condition, use Windows Autopilot Reset to wipe it and automatically re-enrol it to the same tenant. The device is then ready to be assigned to a new employee without IT needing to physically touch it.

## Comparisons

### Retire (Intune Action) vs Wipe (Intune Action)

**Retire (Intune Action):**
- Removes device from management
- Wipes only corporate data, keeps personal data
- Must be used for BYOD (personal devices)

**Wipe (Intune Action):**
- Performs a full factory reset
- Removes all data including operating system
- Must be used for company-owned devices

### Windows Autopilot Reset vs Standard Wipe

**Windows Autopilot Reset:**
- Wipes device then automatically re-enrols to same tenant
- Device ready for next user without manual setup
- Preserves hardware ID association with tenant

**Standard Wipe:**
- Wipes device but does not re-enrol
- Device becomes unmanaged after wipe
- Must manually re-enrol or reinstall OS

### Delete Device from Microsoft Entra ID vs Retire Device from Intune

**Delete Device from Microsoft Entra ID:**
- Breaks the management relationship
- Device still has data and is unmanageable
- Creates an orphaned device

**Retire Device from Intune:**
- Sends wipe/retire command to device
- Device is clean and data is removed
- Device can then be safely deleted

### Conditional Access Policy vs Compliance Policy

**Conditional Access Policy:**
- Controls access to cloud apps based on signals
- Can block sign-in from non-compliant devices
- Works with Microsoft Entra ID

**Compliance Policy:**
- Defines what a healthy device looks like
- Can trigger automatic retirement if violated
- Works with Intune

## Diagram

_A flowchart showing the complete device lifecycle from enrolment through to retirement, including the decision points for wipe, reuse, or physical destruction._

```mermaid
flowchart TD
    A[New Device Arrives] --> B[Enrol in Intune]
    B --> C[Apply Configuration Profiles]
    C --> D[Daily Management & Compliance Checks]
    D --> E{Trigger for Retirement?}
    E -->|User Leaves| F[Back Up Data]
    E -->|Device Lost/Stolen| G[Remote Wipe]
    E -->|Device End of Life| H[Secure Wipe]
    F --> I[Retire or Wipe in Intune]
    G --> I
    H --> I
    I --> J[Delete from Microsoft Entra ID]
    J --> K[Revoke User Sessions]
    K --> L[Update Asset Inventory]
    L --> M{Reuse or Destroy?}
    M -->|Reuse| N[Autopilot Reset and Reassign]
    M -->|Destroy| O[Physical Destruction & Certificate]
```

## Common misconceptions

- **Misconception:** Retiring a device is the same as wiping a device — both remove everything. **Reality:** Retire removes the device from management and wipes only corporate data, leaving personal files intact. Wipe performs a full factory reset, removing all data including the operating system. (Beginners hear 'retire' and 'wipe' used interchangeably in everyday language, but Microsoft Intune defines them as completely separate actions with different consequences.)
- **Misconception:** If you delete a device from Microsoft Entra ID, it is automatically retired and all data is wiped. **Reality:** Deleting the device object in Entra ID only breaks the management relationship. The device itself still has all its data and is no longer manageable. You must retire the device in Intune before deleting it. (Many people assume Entra ID and Intune are the same system, but they are separate services. Deleting from Entra ID is like tearing up the lease document before the tenant moves out — the flat still exists, and you have no way to enforce the move.)
- **Misconception:** You can retire a device while a user is still actively using it, and they will be prompted to save their work. **Reality:** Retiring a device is an immediate, irreversible action. The device is disabled instantly, and the user may lose unsaved work. Always coordinate with the user and ensure data is backed up before retiring. (In everyday language, 'retirement' sounds gradual or planned — like a retirement party where you wrap up your work. In Intune, it is a sudden cut-off.)
- **Misconception:** You only need to worry about device lifecycle for laptops. Printers and monitors also go through the same lifecycle with the same management tools. **Reality:** Device lifecycle management in MD-102 focuses on managed endpoints — laptops, tablets, and phones that run Windows, iOS, Android, or macOS and are enrolled in Intune. Printers and monitors are not managed endpoints and do not use the same lifecycle process. (The term 'device' in IT is broad, but MD-102 specifically targets devices that can be managed with Intune and Microsoft Entra ID. Beginners often overgeneralise.)
- **Misconception:** When you wipe a company-owned laptop, the user can still access their Microsoft 365 apps by signing in again on a different device without re-authentication. **Reality:** Wiping the device does not automatically revoke the user's session tokens or licenses. The administrator must also revoke the user's sign-in sessions in Microsoft Entra ID and remove the device from the user's list of trusted devices to fully secure access. (Wipe only clears data on the hardware. It does not affect the user's identity in the cloud. This is a subtle but critical distinction the exam tests.)

## Key takeaways

- Retire removes corporate data only; Wipe performs a full factory reset — use Retire for personally owned devices (BYOD) and Wipe for company-owned devices.
- Always wipe a lost or stolen device before retiring it, because retiring first may break the communication channel and prevent the wipe command from reaching the device.
- Deleting a device from Microsoft Entra ID without first retiring it in Intune creates an 'orphaned device' that still contains data and cannot be managed remotely.
- Windows Autopilot Reset wipes the device and automatically re-enrols it to the same tenant, making it ready for the next user without IT touching the hardware.
- Set a compliance policy with a retirement grace period to automatically retire devices that fall out of compliance, reducing manual work for IT.
- Physical destruction of storage drives is required for devices that held highly sensitive data, and a certificate of destruction must be retained for compliance audits.
- The order of operations for a lost device is: remote wipe, then retire in Intune, then revoke the user's session tokens in Microsoft Entra ID.
- Device lifecycle management does not cover printers or monitors — only managed endpoints like laptops, tablets, and phones that are enrolled in Intune.

## FAQ

**What happens if I retire a device while the user is still logged in?**

The device immediately loses access to company resources like email and SharePoint. The user may see error messages, and any unsaved work on the device could be lost. Always coordinate with the user first.

**Can a device be retired without an internet connection?**

The retire command is sent over the internet. If the device is offline, the command will be queued in Intune and sent the next time the device connects. You can also use a 'pending' status to track it.

**What is the difference between a 'Wipe' and a 'Factory Reset' on a Windows device?**

In Intune, 'Wipe' is a full factory reset that removes the operating system and all data. A standard 'Factory Reset' in Windows settings only removes personal files but may leave some system data. Intune's Wipe is more thorough.

**Can I recover data from a device after it has been wiped with Intune?**

No. Intune's wipe performs a secure erase that overwrites the encryption keys, making data unrecoverable. If you need data recovery, back up files before initiating the wipe.

**Do I need to retire a device if the user is just being reassigned to a different department?**

No. If the same user keeps the same device, you do not need to retire it. Only retire the device if it is being assigned to a different user or being removed from management.

**What is an 'orphaned device' and how do I fix it?**

An orphaned device is one that has been deleted from Microsoft Entra ID but not retired in Intune. To fix it, you must re-register the device in Entra ID or physically collect it to wipe it manually.

## Check your understanding

1. **You have a company-owned laptop that is being reassigned to a new employee. What Intune action should you use to prepare it?**

   Answer: Use 'Wipe' (factory reset) because the device is company-owned, then use Windows Autopilot Reset to automatically re-enrol it for the next user.

2. **A user reports their personal iPad enrolled for work email has been lost. Should you use Retire or Wipe?**

   Answer: Use Retire, because it is a personally owned device (BYOD). Retire removes only corporate data, leaving the user's personal data intact if the device is later found.

3. **What is the correct order of actions when a company laptop is stolen?**

   Answer: First, remotely wipe the laptop using Intune. Then, retire the device. Finally, revoke the user's session tokens in Microsoft Entra ID to block further access.

4. **What happens if you delete a device from Microsoft Entra ID before retiring it in Intune?**

   Answer: The device becomes 'orphaned' — it still has all its data but cannot be managed or wiped remotely. You must physically collect it to secure it manually.

5. **What is the difference between a 'Retire' action on a company-owned device versus a BYOD device?**

   Answer: On a company-owned device, you always use 'Wipe' (full factory reset). On a BYOD device, you use 'Retire' which only removes corporate data and leaves personal files intact.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/md-102/managing-device-lifecycle-and-retirement