> For the complete documentation index, see [llms.txt](https://docs.realmjoin.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.realmjoin.com/automation/runbooks/runbook-references/device/general/wipe-managed-app-data.md).

# Wipe Managed App Data

### Description

Performs an "App selective wipe" (Mobile Application Management) for this device, mirroring the Intune portal flow "Apps > App selective wipe > Create wipe request". It removes company data from apps protected by app protection policies without wiping the whole device - typically used for lost or stolen devices that are MAM-managed (not MDM-enrolled).

The runbook resolves the users registered on the device, collects their MAM app registrations that belong to this device and creates a wipe request for each affected user/device tag. The wipe is executed the next time each protected app checks in. Wipe requests can be monitored and cancelled in the Intune portal under "Apps > App selective wipe".

### Device matching

MAM app registrations belong to a user, not to a device object. The runbook therefore resolves the users registered on the device and matches their app registrations against the device's EntraID device id (`azureADDeviceId`). Registrations without an EntraID device id are matched by the device's display name as fallback; the runbook output indicates when this fallback was used.

### Wipe behavior

* The company app data is removed the next time each protected app checks in on the device; the wipe is not instantaneous.
* Pending wipe requests can be monitored and cancelled in the Intune portal under *Apps > App selective wipe*.
* Only app data protected by app protection policies (MAM) is affected. The device object itself is not touched: it remains in EntraID (and in Intune/Autopilot, if it is additionally MDM-enrolled). To disable or remove the device there as well, run the **Outphase Device** runbook (Device \ General) afterwards; for a full wipe of MDM-enrolled devices use **Wipe Device**.

### Location

Device → General → Wipe Managed App Data

**Full Runbook name**

rjgit-device\_general\_wipe-managed-app-data

### Details

| Property         | Value                                                                                   |
| ---------------- | --------------------------------------------------------------------------------------- |
| Version          | 1.0.0                                                                                   |
| Required modules | <p>RealmJoin.RunbookHelper (>= 0.8.9)<br>Microsoft.Graph.Authentication (>= 2.39.0)</p> |
| Schedulable      | no                                                                                      |

### Permissions

#### Application permissions

* **Type**: Microsoft Graph
  * DeviceManagementApps.ReadWrite.All
    * *Reads the user's managedAppRegistrations and creates MAM wipes via wipeManagedAppRegistrationsByDeviceTag*
  * Device.Read.All
    * *Resolves the target device via /devices and lists its registered users and owners*
  * User.Read.All
    * *Reads the registered users' id and UPN to build the per-user MAM registration queries*

#### RBAC roles

* Intune Administrator
  * *Grants Intune RBAC for reading managedAppRegistrations and posting the app-only MAM wipe*

### Parameters

#### DeviceId

The device ID of the target device.

| Property         | Value                                  |
| ---------------- | -------------------------------------- |
| Required         | true                                   |
| Default Value    |                                        |
| Type             | String                                 |
| Hidden in portal | yes (preset via runbook customization) |

[Back to Runbook Reference overview](/automation/runbooks/runbook-references.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.realmjoin.com/automation/runbooks/runbook-references/device/general/wipe-managed-app-data.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.