> For the complete documentation index, see [llms.txt](https://docs.realmjoin.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.realmjoin.com/automation/runbooks/runbook-references/device/general/wipe-managed-app-data.md).

# Wipe Managed App Data

Remove company app data from this MAM-managed device

### Description

Removes company data from apps protected by app protection policies on this device, without wiping the whole device. This is the app selective wipe known from the Intune portal, typically used for lost or stolen devices that are managed by app protection only and not enrolled in Intune. The data is removed the next time each protected app checks in, so the wipe is not instant. Pending requests can be monitored and cancelled in the Intune portal.

### Device matching

MAM app registrations belong to a user, not to a device object. The runbook therefore resolves the users registered on the device and matches their app registrations against the device's EntraID device id (`azureADDeviceId`). Registrations without an EntraID device id are matched by the device's display name as fallback; the runbook output indicates when this fallback was used.

### Wipe behavior

* The company app data is removed the next time each protected app checks in on the device; the wipe is not instantaneous.
* Pending wipe requests can be monitored and cancelled in the Intune portal under *Apps > App selective wipe*.
* Only app data protected by app protection policies (MAM) is affected. The device object itself is not touched: it remains in EntraID (and in Intune/Autopilot, if it is additionally MDM-enrolled). To disable or remove the device there as well, run the **Outphase Device** runbook (Device \ General) afterwards; for a full wipe of MDM-enrolled devices use **Wipe Device**.

### Location

Device → General → Wipe Managed App Data

**Full Runbook name**

rjgit-device\_general\_wipe-managed-app-data

### Details

| Property         | Value                                                                                    |
| ---------------- | ---------------------------------------------------------------------------------------- |
| Version          | 1.0.0                                                                                    |
| Required modules | <p>RealmJoin.RunbookHelper (>= 0.8.10)<br>Microsoft.Graph.Authentication (>= 2.41.2)</p> |
| Schedulable      | no                                                                                       |

### Permissions

#### Application permissions

* **Type**: Microsoft Graph
  * DeviceManagementApps.ReadWrite.All
    * *Reads the user's managedAppRegistrations and creates MAM wipes via wipeManagedAppRegistrationsByDeviceTag*
  * Device.Read.All
    * *Resolves the target device via /devices and lists its registered users and owners*
  * User.Read.All
    * *Reads the registered users' id and UPN to build the per-user MAM registration queries*

#### RBAC roles

* Intune Administrator
  * *Grants Intune RBAC for reading managedAppRegistrations and posting the app-only MAM wipe*

### Parameters

#### DeviceId

Entra ID device ID of the device the runbook acts on. Set by the portal from the selected device.

| Property         | Value                                  |
| ---------------- | -------------------------------------- |
| Required         | true                                   |
| Default Value    |                                        |
| Type             | String                                 |
| Hidden in portal | yes (preset via runbook customization) |

[Back to Runbook Reference overview](/automation/runbooks/runbook-references.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.realmjoin.com/automation/runbooks/runbook-references/device/general/wipe-managed-app-data.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.