Skip to main content
Microsoft Intune provides AI agent tools for device lookups, maintenance, and retirement operations. Reference these tools in using @ mentions so your agent can find managed devices, check installed applications, force check-ins, rotate BitLocker keys, and reset or retire devices without escalating to IT. These tools use the same Microsoft Intune integration as the workflow actions, but their inputs are built for an agent.

​
Look up devices

Find devices

Searches for Intune-managed devices belonging to the ticket requester. All input fields are optional filters. When multiple devices match, the agent surfaces the list so the requester can pick one before calling any device-targeted tool.Tool name: @Find DevicesInput fields:
  • serialNumber - device serial number.
  • deviceName - device name.
  • model - device model, for example “Surface Pro”, “iPhone 15”, or “ThinkPad X1”.
  • operatingSystem - operating system, for example “Windows”, “iOS”, “Android”, or “macOS”.
Output data:
  • devices - matched devices, each with id, deviceName, operatingSystem, osVersion, model, serialNumber, userPrincipalName, lastSyncDateTime, complianceState, and manufacturer.
Common use cases:
  • Look up a requester’s devices when troubleshooting a hardware or software issue
  • Verify device compliance before approving an access request
  • Identify a device’s serial number or OS version for IT support
  • Check when a device last synced with Intune
Example rule:

When a user reports a device issue, use @Find Devices to look up their managed devices in Intune. If multiple devices come back, ask which one they mean. If the device is non-compliant, tell the user before troubleshooting.

Lists detected applications installed on a specific Intune-managed device. Requires a device ID from Find Devices. Use the optional filters to narrow results when a device has many installed applications.Tool name: @Get Device AppsInput fields:
  • intuneDeviceId (required) - the Intune managed device ID, obtained from Find Devices.
  • appName - filter by app name, substring match.
  • platform - filter by platform, for example “windows”, “ios”, or “macOS”.
  • publisher - filter by publisher name, substring match.
Output data:
  • apps - detected apps, each with id, displayName, version, publisher, and platform.
Common use cases:
  • Verify whether a specific application is installed on a user’s device
  • Audit installed software for compliance or licensing
  • Troubleshoot application issues by checking installed versions
  • Identify outdated software that needs updating
Example rule:

When a user reports a software issue, use @Find Devices to locate their device, then use @Get Device Apps to check which applications are installed. If an app is missing or outdated, let the user know.

​
Maintain devices

Forces a device to check in with Intune and pull pending policies, configuration profiles, and compliance updates. Use it after enqueuing actions such as a BitLocker key rotation to make them run immediately rather than waiting for the next scheduled check-in.Tool name: @Sync DeviceInput fields:
  • intuneDeviceId (required) - the Intune managed device ID, obtained from Find Devices.
Common use cases:
  • Push urgent policy updates when a user reports missing configurations
  • Trigger a check-in immediately after enqueuing a BitLocker key rotation
  • Verify a device picks up new compliance requirements
  • Troubleshoot devices that appear out of sync
Example rule:

When a user reports they are missing an expected policy or configuration, use @Find Devices to locate their device, then use @Sync Device to force a check-in. Let the user know their device is syncing and to check again in a few minutes.

Enqueues a rotation of the BitLocker recovery key for a Windows device managed by Intune. The rotation runs the next time the device checks in; run Sync Device immediately after to trigger a check-in. The new key is stored in Intune and is not returned by this tool. The device must belong to the current requester.Tool name: @Rotate BitLocker KeyInput fields:
  • intuneDeviceId (required) - the Intune managed device ID, obtained from Find Devices. Must belong to the current requester.
Common use cases:
  • Rotate a recovery key after it was shared during a support session
  • Rotate keys as part of a security compliance cycle
  • Respond to a security incident by rotating encryption keys
Example rule:

After helping a user with a BitLocker recovery, use @Find Devices to locate their device, then use @Rotate BitLocker Key to rotate the recovery key. Follow up with @Sync Device to trigger a check-in immediately, and confirm to the user that the key has been rotated.

​
Reset and retire devices

Triggers an Autopilot reset on a managed Windows device. The device is wiped and re-provisioned from scratch through Windows Autopilot. All user data is erased. The reset is queued on Intune and runs the next time the device checks in. The device must belong to the current requester.
An Autopilot reset wipes all data from the device and re-provisions it from scratch. Confirm with the requester before running this tool.
Tool name: @Autopilot ResetInput fields:
  • intuneDeviceId (required) - the Intune managed device ID, obtained from Find Devices. Must belong to the current requester.
Common use cases:
  • Reset a device when troubleshooting reveals a system-level issue
  • Reprovision a device for a new user
  • Prepare a device for decommissioning
Example rule:

If a user needs their Windows device fully reset, use @Find Devices to locate the device and ask them to confirm before proceeding, then run @Autopilot Reset. Tell them the reset is queued and will run on the next device check-in.

Removes company data and unenrolls a device from Intune management while leaving personal data intact. The retire command is queued on Intune and runs the next time the device checks in. The device must belong to the current requester.
Retiring a device removes all company data and unenrolls it from Intune management. Confirm with the requester before running this tool.
Tool name: @Retire DeviceInput fields:
  • intuneDeviceId (required) - the Intune managed device ID, obtained from Find Devices. Must belong to the current requester.
Common use cases:
  • Remove corporate data from a BYOD device during offboarding
  • Retire a device that should no longer be managed
  • Unenroll a device after a user leaves the organization
Example rule:

When processing an offboarding request, use @Find Devices to locate the user's device, then use @Retire Device to remove company data and unenroll it from management. Confirm with the user that company data has been removed from their device.

Device wipe and script assignment are available as workflow actions.
A tool with no execution policy set runs without asking. When Copilot drafts a rule, it suggests Requires confirmation for write tools and Requires approval for delete tools, and you can change either per rule. See tool execution policies.

​
Setup

1

Install Intune integration

Follow the Microsoft Intune setup guide to connect your Intune tenant to Ravenna.
2

Configure agent

Open your agent’s settings and add the Intune tools you want it to use under Tools. An admin has to attach each tool before an agent or rule can call it.
3

Create rules

Write that reference Intune tools using @ mentions.
4

Test tools

Test your rules on a real request to verify the tools return the expected device data.

​
Best practices

  • Find devices first. All device-targeted tools require an intuneDeviceId. Use @Find Devices at the start of every flow to resolve the requester’s device before calling any other tool.
  • Confirm before destructive actions. Gate @Autopilot Reset and @Retire Device behind Requires approval in rules an agent can reach on its own, or have the rule ask the requester to confirm before calling either tool.
  • Sync after enqueuing. Actions like @Rotate BitLocker Key are queued and run at the next device check-in. Chain @Sync Device immediately after to make them run sooner.
  • Filter app results. When a device has many installed applications, pass appName, platform, or publisher to @Get Device Apps to avoid returning a large list.
Learn more about configuring agents and Microsoft Intune workflow actions
Last modified on September 29, 2026