Remote device actions for ChromeOS

Remotely run device actions on ChromeOS devices synced with Microsoft Intune. There are four remote actions supported on ChromeOS devices:

• Deprovision
• Lost mode, known in Chrome Enterprise as disabling a device
• Wipe
• Restart (only for kiosk devices and managed guest session devices)

To access remote actions, select a device in your Chrome Enterprise list or go to Devices > All devices and select a device. This article describes the remote actions, and provides information about required permissions and known issues.

Prerequisites

Set up the Chrome Enterprise connector with Microsoft Intune, and enroll devices using the Google Admin console.

Permission requirements are provided in the sections that follow.

Deprovision

Select Deprovision to remove Google Admin policies from devices your organization no longer uses. To deprovision a ChromeOS device, you must be assigned a role that has the Remote tasks: Retire permission.

After you deprovision a device, it remains in the Intune admin center and the Google Admin console. Then on the admin center System info page, the device status changes to DEPROVISIONED. The device can't be enrolled again until you restore it to factory settings. For more information about the deprovision action, such as how to select the best reason for deprovisioning, see the Chrome Enterprise and Education Help documentation.

Lost mode

Select Lost mode to prevent other people from using a lost or stolen ChromeOS device. Devices in lost mode display the contact information and message you configured in the Google Admin console. To deprovision a device, you must be assigned a role that has the following permissions:

• Remote tasks: Enable lost mode
• Remote tasks: Disable lost mode

Wipe

Select Wipe to remove data from a device. With this action, you can either:

• Remove user profiles only: This option removes all user account data. Device and enrollment policies remain on the device.
• Factory reset (powerwash): This option fully restores a device to its factory state, removing all personal and work data. Before using this action, deprovision the device. Otherwise, once it connects to Wi-Fi, it will automatically enroll again.

To wipe a device, you must be assigned a role that has the Remote tasks: Wipe permission. For more information about wiping ChromeOS devices, see Wipe ChromeOS device data (opens Google Chrome Enterprise Help).

Restart

Select Restart to restart a device. To restart a device, you must be assigned a role that has the Remote tasks: Reboot now permission.

Restart is only available for kiosk devices and managed guest session devices. The restart fails on any other type of device. For more information, see Kiosk apps, managed guest sessions, and smart cards (opens Google Chrome Enterprise Help).

Bulk device actions

You can issue all of these remote actions as part of a bulk device action. For more information about how to do that, see Use bulk device actions.

Known issues

In some cases, device commands remain in a pending state, even if they’ve already completed or failed.