Does an Intune Wipe Count as NIST 800-88 Purge?

Does an Intune wipe count as NIST 800-88 Purge? Not on the evidence Microsoft publishes. An Intune wipe on Windows is a Windows reset. Microsoft documents the default as equivalent to Reset this PC > Remove everything with Clean Data set to No, and says the reset's erasure option "is targeted at consumers and does not meet government and industry data erasure standards." None of the Microsoft pages we read say the reset sends the drive its own sanitize command. That command is how NIST SP 800-88 Rev. 2 and IEEE 2883 describe logical Purge.

So Intune is the right tool while a laptop is out with a person. It is not the record you need when that laptop leaves the company for good.

This guide is for IT and MSP teams retiring Windows laptops. It covers what each Intune action does, in Microsoft's words, how each one lines up with NIST's Clear and Purge, where the sources go quiet, and what an auditor actually receives.

---

1. What each Intune action does

Intune has five actions people reach for when a laptop changes hands. Three are options of Wipe. Two are separate actions.

Three plain readings fall out of that table:

• Retire and Fresh Start are not wipes. Retire is built to leave personal data in place. Fresh Start is built to clear out apps.
• Keep enrollment state keeps the user's files. Microsoft's push-button reset page says Keep my files "preserves most folders and files that are not part of a standard Windows installation." Don't pick it for a laptop that's leaving.
• Autopilot Reset is for the next user in your own company. It keeps the laptop tied to your tenant on purpose. The RemoteWipe CSP says it "works like PC Reset... except that it keeps the device enrolled in Microsoft Entra ID and MDM."

That leaves the two real candidates for a laptop on its way out: plain Wipe and protected wipe.

2. What a Windows reset does to the drive

Every Wipe option runs Windows' own reset. Microsoft's push-button reset page explains what that does.

• Windows rebuilds itself from its own files. Reset works "by constructing a new copy of the OS using runtime system files located in the Windows Component Store."
• The Windows volume is never formatted. "The Windows volume is never formatted, as the files needed to rebuild the OS are on it. Instead, user data files are deleted individually." Other data volumes are formatted only if the user chooses all volumes.
• Erasure is an option, and Microsoft rates it plainly. The user can choose to "also perform data erasure on the drive(s) so that recovery of the data by someone else is much more difficult." Then: "The data erasure functionality is targeted at consumers and does not meet government and industry data erasure standards."

The default Intune wipe doesn't even pick that option. Its CSP sets Clean Data to No.

The protected wipe is different. Microsoft's CSP says it will "fully clean the internal drive," and the Intune page says it "overwrites the free space." Microsoft doesn't say in so many words that this is the same erasure option as the consumer reset. It is the only erasure the reset documents, though.

What none of these pages say: that the reset sends the drive its own sanitize command, such as NVMe Sanitize, NVMe Format with secure erase, or ATA Secure Erase. Everything Microsoft describes happens through Windows: deleting files, formatting volumes, overwriting free space.

3. Mapping it to NIST SP 800-88 Rev. 2

NIST defines three methods. Two matter here. From the Rev. 2 glossary:

• Clear: "A method of sanitization that applies logical techniques to sanitize data in all user-addressable storage locations for protection against simple, non-invasive data recovery techniques using the same interface that is available to the user."
• Purge: "A method of sanitization that applies physical or logical techniques to render target data recovery infeasible using state-of-the-art laboratory techniques."

Section 3.1.2 says how logical Purge is done: IEEE 2883 "should be consulted," and techniques "can include overwrite, block erase, and cryptographic erase using dedicated, standardized device sanitize commands that apply ISM-specific techniques to bypass the abstraction inherent in typical read and write commands." (ISM is NIST's term for a storage device.)

Here's how the documented behaviour lines up.

Two points about that table deserve a closer look.

"Reset to factory" is only Clear when you can't overwrite. NIST does allow "a menu option to reset the ISM to the factory state," but only "if rewriting is not supported," as on "a basic cell phone." A laptop drive supports rewriting, so a factory reset doesn't qualify as Clear just by being a factory reset.

Overwriting an SSD through Windows can't reach everything. NIST Section 3.1.1 says flash drives "that contain spare cells and perform wear levelling make it infeasible for a user to sanitize all previous data using this approach." So if the laptop has an SSD, even a perfect overwrite through Windows is not Purge. For what the drive's own commands do, see our NVMe Format vs Sanitize guide.

4. What about BitLocker?

Most managed laptops run BitLocker. Destroying the encryption key, called cryptographic erase, is a recognised Purge technique. So it's fair to ask whether a wipe that throws away the BitLocker key counts.

The honest answer: Microsoft's Wipe, RemoteWipe CSP and push-button reset pages don't say what happens to the BitLocker keys. The reset page mentions BitLocker once, to say erasure takes longer on an encrypted drive.

Even if a reset did discard the key, NIST sets conditions before you can rely on that.

• Escrowed keys. Section 3.2.2: cryptographic erase "should not be trusted on ISM that have been backed up or escrowed unless the organization has a high level of confidence regarding how and where the keys were stored and managed outside of the ISM." Microsoft's BitLocker guide for Intune says that with silent encryption, "recovery keys are automatically backed up to Microsoft Entra ID."
• Data written before encryption. The same section says cryptographic erase assumes "no sensitive data has previously been stored on the ISM in plaintext form." Microsoft says silent BitLocker on modern standby devices uses "used space only encryption." Whether old plaintext sits in the unencrypted space depends on that laptop's history. Nothing in Intune reports it.

One more detail matters for the order you do things in. Microsoft says that if you retire or delete the Intune object for a Microsoft Entra joined device protected by BitLocker, Intune "removes key protectors" and leaves "BitLocker in a suspended state" on the OS volume. Microsoft's stated reason is "to prevent unrecoverable encryption scenarios." That's the right call for a user who needs their files back. It's the wrong state for a laptop leaving the building before its drive is sanitized.

5. What an Intune wipe leaves for an auditor

NIST Section 4.6 says a certificate of sanitization "should be completed for each ISM that has been sanitized." Here's what that certificate asks for, next to what Intune's documentation describes.

The closest thing to a result is a status code. For Autopilot Reset, the CSP's Status node goes from "0: Never run" to "1: Complete," with failure codes such as "40: Failed: power requirements not met." That tells you the reset ran. It doesn't tell you what happened to the data on the drive.

For more on what a full record holds, see our certificate of sanitization template and the NIST SP 800-88 standards page.

6. A sensible order for retiring a managed laptop

Microsoft's own wipe page suggests the clean-up steps. NIST supplies the rest.

1. While the laptop is out: use Intune Wipe if it's lost or won't come back. It protects the data until you get the device.
2. When it comes back: don't retire or delete it in Intune yet, for the BitLocker reason in section 4.
3. Sanitize each drive with a Purge technique the drive supports, using its own commands. Verify it, and record it per drive.
4. Then tidy up the tenant. Microsoft's wipe page says you "might also want to remove its registration from Windows Autopilot" and remove its record from Microsoft Entra ID.
5. Keep the certificate with the asset record before the laptop is resold, donated or recycled.

7. Where reCore fits

reCore covers step 3. It doesn't replace your MDM, and it doesn't plug into Intune. It doesn't send Intune commands or read Intune's status.

When a laptop comes back, someone boots it from a USB stick into the reCore OS. It appears in your dashboard, where you can start the wipe from any browser, on one drive or across many machines. Here's what happens to each drive, checked against the product's code:

• The drive's own commands first. reCore reads what each drive supports and picks the strongest option: NVMe cryptographic erase, NVMe Format with secure erase, NVMe Sanitize, or ATA Secure Erase. If the drive offers none of them, it falls back to an overwrite and records it as Clear, not Purge.
• A check that matches the method. After the wipe, the drive is read back in a way suited to how it was wiped.
• One certificate per drive. It carries the drive's serial number, the NIST method and technique, and the tool version. It is issued only after a second person, not the operator who ran the wipe, approves it.

The remote data wipe page shows how that works from the dashboard. For the difference between this and an MDM reset, see remote data wipe for ITAD.

Conclusion

An Intune wipe is a good answer to "this laptop is gone, protect the data." It isn't a good answer to "prove this drive was sanitized." Microsoft documents it as a Windows reset, rates the reset's erasure as consumer-grade, and doesn't say it uses the drive's own sanitize command. NIST asks for Purge-grade techniques and a certificate per drive. Use Intune while the laptop is out. When it comes back, Purge each drive, record it, then clean up the tenant.

---

Sources

• Microsoft Learn, Wipe devices with Microsoft Intune (updated September 2026).
• Microsoft Learn, RemoteWipe CSP (updated October 2026).
• Microsoft Learn, How push-button reset features work.
• Microsoft Learn, Device action: Retire.
• Microsoft Learn, Device action: Fresh Start.
• Microsoft Learn, Windows Autopilot Reset.
• Microsoft Learn, Encrypt Windows devices with BitLocker using Intune.
• NIST, SP 800-88 Rev. 2, Guidelines for Media Sanitization, September 2025: Sections 3.1.1, 3.1.2, 3.2.2, 4.6 and Appendix A.