> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Erase a Device

> Remotely erase a managed device from Iru Endpoint. Wipe all data and settings on Mac, iPhone, iPad, Apple TV, Windows, and Android devices.

<Callout icon="earth-americas" color="#B84A7A" iconType="regular">This guide applies to all device platforms</Callout>

### About Device Erase

You can use the **Erase Device** command on macOS, iOS, iPadOS, tvOS, visionOS, Windows, and Android devices. For Apple devices, this command doesn't require supervision.

### How It Works

The Erase Device command permanently removes all data and settings from a device, returning it to factory defaults. The command is delivered through the platform's MDM framework and executes when the device is online or queued for offline devices.

<Warning>
  A locked Apple device cannot receive an Erase Device MDM command. For more information on locking a device, see our [Lock a Device](/en/endpoint/devices/device-actions/lock-a-device) support article.
</Warning>

## Platform-Specific Erase Information

<Tabs>
  <Tab title="Apple Devices">
    ### Erase Apple Devices

    <Steps>
      <Step title="Navigate to Device Record">
        Navigate to the **Device Record** in the Iru Web App.
      </Step>

      <Step title="Open Device Action Menu">
        Open the **Device Action Menu** (ellipsis).
      </Step>

      <Step title="Select Erase Device">
        Select **Erase Device**.
      </Step>

      <Step title="Configure Erase Options">
        In the confirmation dialog, review the erase details. For iOS and iPadOS 17+ devices, you can select **Return to Service** and provide a valid Wi-Fi profile if desired.
      </Step>

      <Step title="Confirm Erase">
        Type `ERASE` in the confirmation field and click **Erase Device** to send the command.
      </Step>
    </Steps>

    <Note>
      The erase command will remove all data and settings from the device, returning it to factory defaults.
    </Note>

    ### Apple Device Considerations

    * **Supervision not required** - Erase commands work on both supervised and unsupervised devices
    * **Immediate execution** - Commands are sent via MDM and execute when the device is online
    * **Data recovery** - All data will be permanently deleted and cannot be recovered
    * **eSIM preservation** - eSIM-based cellular plans are automatically preserved when using the Iru Web App

    ### Apple Erase Behavior

    #### macOS Erase Behavior

    Depending on the macOS version and hardware support, different erase behaviors will occur:

    ##### Erase All Content and Settings (EACS)

    * **Apple Silicon Macs (macOS 12+)**: Performs EACS
    * **Intel Macs with T2 (macOS 12+)**: Performs EACS
    * **Fallback**: If EACS fails, device reverts to obliteration behavior

    ##### Obliteration Behavior

    * **Apple Silicon Macs (macOS 11 and earlier)**: Obliteration without PIN
    * **Intel Macs with T1/No security chip (macOS 12+)**: Obliteration with 6-digit PIN
    * **Intel Macs with T1/No security chip (macOS 11 and earlier)**: Obliteration with 6-digit PIN

    <Note>
      A 6-digit PIN is automatically generated and available on the device record once the device receives the command. Erase device PINs are not supported on Mac computers with Apple silicon.
    </Note>

    #### iOS and iPadOS Erase Behavior

    * **Erase All Content and Settings**: Device restarts and presents Setup Assistant
    * **Not a full system restore**: Device will not be updated to the latest version
    * **eSIM preservation**: Cellular plans are automatically preserved when using the Iru Web App

    <span id="return-to-service-ios-ipados-17" />

    #### Return to Service (iOS/iPadOS 17+)

    When erasing iOS or iPadOS 17+ devices, you can select **Return to Service** which:

    * **Automatic setup**: Device proceeds through Setup Assistant to home screen without user intervention
    * **Auto re-enrollment**: Device automatically re-enrolls into Iru after erasure
    * **Wi-Fi configuration**: Automatically joins Wi-Fi network from selected Library Item
    * **Ethernet support**: Works with tethered Ethernet connections (kiosks) without Wi-Fi profile

    <Warning>
      **Return to Service Considerations:**

      * Activation Lock must be removed before issuing Return to Service command
      * Do not select Library Items with EAP-TLS 802.1X networks with SCEP client identity
      * Return to Service will not work with Automated Device Enrollment that requires authentication
      * Self Service apps will not automatically reinstall when erased from Iru (unlike user-initiated erases)
    </Warning>

    #### tvOS and visionOS Erase Behavior

    * **tvOS**: Initiates a Reset, device reboots and presents Setup Assistant
    * **visionOS**: Initiates Erase All Contents and Settings

    #### EACS Requirements

    * **Bootstrap token required**: EACS will fail if no bootstrap token is escrowed
    * **Recommended method**: Use Iru Web App rather than local Erase Assistant for better results
    * **Auto Advance preparation**: Properly prepares Mac for re-enrollment using Auto Advance

    #### Legacy Firmware Passwords

    <Warning>
      In macOS Monterey, Intel-based Macs with T2 Security Chip will perform EACS when receiving an Erase Device command from Iru. However, if a legacy firmware password is present, the device will completely erase and require macOS reinstallation. To preserve EACS behavior, move the device to a Blueprint without a Recovery Password Library Item before sending the Erase Device command.
    </Warning>

    ### Erase Command Execution

    #### Command Delivery

    * **MDM Channel**: Erase commands are delivered through the platform's MDM framework
    * **Immediate Delivery**: Commands are sent immediately when the device is online
    * **Queue for Offline Devices**: Commands are queued and delivered when the device comes online

    #### Execution Timeline

    <CardGroup cols={2}>
      <Card title="Online Devices" icon="wifi">
        Commands execute within minutes of being sent for devices that are currently online.
      </Card>

      <Card title="Offline Devices" icon="wifi-off">
        Commands are queued and will execute when the device next connects to the internet.
      </Card>
    </CardGroup>
  </Tab>

  <Tab title="Windows">
    ### Erase Windows Devices

    When you erase a Windows device, Iru Endpoint sends a remote wipe command over MDM. You choose one of three erase types. The type you select controls how Windows is reinstalled and how the device handles an interrupted wipe.

    None of the three erase types retain user data. All three remove all data and apps from the device, equivalent to a factory reset. Back up anything you need to keep before you erase.

    <Steps>
      <Step title="Navigate to Device Record">
        Navigate to the **Device Record** in the Iru Web App.
      </Step>

      <Step title="Open Device Action Menu">
        Open the **Device Action Menu** (ellipsis).
      </Step>

      <Step title="Select Erase Device">
        Select **Erase Device**.
      </Step>

      <Step title="Choose Erase Type">
        In the confirmation dialog, choose an **Erase type**:

        * **Local**: Rebuilds Windows using the recovery image already stored on the device
        * **Cloud**: Downloads a fresh copy of the Windows installation files from Microsoft's servers
        * **Protected**: Fully cleans the internal drive and continues retrying until the wipe completes. Recommended for lost or stolen devices
      </Step>

      <Step title="Confirm Erase">
        Type `ERASE` in the confirmation field and click **Erase Device** to send the command.
      </Step>
    </Steps>

    <Note>
      The erase command is queued and will execute the next time the device is connected to the internet.
    </Note>

    ### Choose an Erase Type

    #### Local

    * Rebuilds Windows using the recovery image already stored on the device
    * Fastest option, and does not require an internet connection to reinstall Windows
    * Equivalent to **Reset this PC > Remove everything** in Windows Settings with **Keep my files** turned off
    * If the wipe is interrupted (for example, by a power loss), Windows attempts to roll back to its pre-wipe state
    * If rollback fails, the device can become unusable and may require a manual Windows reinstall

    #### Cloud

    * Downloads a fresh copy of the Windows installation files from Microsoft's servers instead of using the local recovery image
    * Returns the device to a current, unmodified Windows build
    * Useful when the local recovery image is missing, outdated, or otherwise untrusted
    * Requires the device to remain connected to the internet for the duration of the wipe

    #### Protected

    * Performs the most thorough wipe available
    * Fully cleans the internal drive and continues retrying until the wipe completes, even if the device is power cycled or otherwise interrupted
    * Designed by Microsoft for lost or stolen devices
    * Unlike Local, Protected does not prioritize rolling back to a working state if interrupted. It prioritizes leaving the drive clean
    * In some device configurations, a Protected erase can leave the device unable to boot. This is expected behavior. The goal is to ensure data is removed, not to preserve a bootable device

    ### Windows Considerations

    #### Choosing Between Local, Cloud, and Protected

    * Use **Local** for routine device retirement or reimaging when you have the device on hand and do not need the latest Windows build
    * Use **Cloud** when you want the device to return to a current, unmodified Windows build, or when you cannot trust the device's local recovery image
    * Use **Protected** when the device is lost, stolen, or otherwise outside your physical control. It is designed to complete the wipe even if someone tries to interrupt it

    #### Interrupted Wipes Can Leave a Device Unusable

    Local and Protected erases both carry a risk that an interrupted wipe leaves the device unable to boot, requiring a manual Windows reinstall to recover. This is how Windows handles interrupted resets, and it is not controlled by Iru Endpoint. Protected accepts this risk intentionally: it prioritizes completing the wipe over preserving a bootable device, which is appropriate when data protection is more important than recovering the hardware.

    ### Windows Best Practices

    <CardGroup cols={2}>
      <Card title="Default to Local for standard offboarding" icon="laptop">
        Local is the fastest option and does not depend on network connectivity, so it is the best default when a device is changing hands or being reimaged.
      </Card>

      <Card title="Use Protected for lost or stolen devices" icon="shield">
        Queue the Protected erase as soon as a device is reported lost or stolen so it runs the next time the device connects.
      </Card>

      <Card title="Use Cloud when the recovery image may be unreliable" icon="cloud">
        If a device has a history of failed resets or a corrupted recovery partition, Cloud downloads fresh installation files from Microsoft instead of relying on the local image.
      </Card>
    </CardGroup>
  </Tab>

  <Tab title="Android">
    ### Erase Android Devices

    <Steps>
      <Step title="Navigate to Device Record">
        Navigate to the **Device Record** in the Iru Web App.
      </Step>

      <Step title="Open Device Action Menu">
        Open the **Device Action Menu** (ellipsis).
      </Step>

      <Step title="Select Erase Device">
        Select **Erase Device**.
      </Step>

      <Step title="Configure Erase Options">
        In the confirmation dialog, review the erase details and optionally configure:

        * **Erase external storage**: Erase any connected SD cards or external storage drives
        * **Erase eSIMs**: Erase any installed eSIMs
      </Step>

      <Step title="Confirm Erase">
        Type `ERASE` in the confirmation field and click **Erase Device** to send the command.
      </Step>
    </Steps>

    <Note>
      Android erase commands work through the Android Management API and will factory reset the device.
    </Note>

    ### Android Erase Behavior

    Android erase commands perform a factory reset on the device. All data, applications, and settings are removed, and the device returns to initial setup state.
  </Tab>
</Tabs>

<Warning>
  **Important**: Erasing a device will permanently delete all data and cannot be undone. Ensure you have backed up any important data before proceeding.
</Warning>

### Related Articles

<CardGroup cols={2}>
  <Card title="Lock a Device" icon="lock" href="/en/endpoint/devices/device-actions/lock-a-device">
    Remotely lock a managed device and optionally display a message on the lock screen
  </Card>

  <Card title="Enable Lost Mode" icon="location-dot" href="/en/endpoint/devices/device-actions/enable-lost-mode">
    Activate Lost Mode on managed iOS and iPadOS devices to lock the device and track its location
  </Card>

  <Card title="Deleting a Device Record and Uninstalling Iru Endpoint" icon="trash" href="/en/endpoint/devices/device-record-management/deleting-a-device-record-and-uninstalling-iru-endpoint">
    Delete device records and uninstall Iru Endpoint when preparing devices for reassignment or removal
  </Card>

  <Card title="Self Service for iOS, iPadOS, and visionOS" icon="mobile" href="/en/endpoint/settings/self-service/self-service-for-ios-ipados-and-visionos">
    Configure Return to Service and other Self Service options for iOS, iPadOS, and visionOS
  </Card>
</CardGroup>