How do I use MDM actions on a device?

Before you begin

• Your company must have an MDM provider connected in Velory (set up under Settings → Integrations).
• The device must be enrolled in the MDM — not all company devices are necessarily managed.
• You need Admin access to perform MDM actions.

Where to find MDM actions

1. Go to Assets → Hardware.
2. Click on a device that is enrolled in your MDM.
3. On the Details tab, scroll to the MDM Information card. The actions are under Device Actions.

If the device is MDM-managed, you will see the provider name and available actions. If not, this section will not appear.

Lock a device

Use this to remotely lock a device — for example, if an employee leaves it unattended or if you need to secure it quickly.

1. Open the device's detail page.
2. Click Lock Device in the MDM section.
3. Confirm the action in the dialog.

The device will be locked remotely. The employee will need to enter their passcode or password to unlock it.

Enable Lost Mode

Lost Mode locks the device and displays a message on the screen — useful when a device has been misplaced and you want to help someone return it.

1. Open the device's detail page.
2. Click Enable Lost Mode.
3. Enter an optional message to display on the lock screen (e.g. "This device belongs to Acme Corp.").
4. Enter an optional phone number for the finder to call.
5. Confirm the action.

The device will be locked and show your message on the screen.

Tip: Combine Lost Mode with the Report Lost action (under the Actions menu) to also update the device's state in Velory.

Wipe a device

Wiping a device performs a factory reset, erasing all data. Use this as a last resort — for example, when a device is stolen or needs to be decommissioned and you cannot access it physically.

1. Open the device's detail page.
2. Click Wipe Device.
3. Type the device name in the confirmation field to confirm you understand the consequences.
4. Confirm the action.

Warning: This action is irreversible. All data on the device will be permanently erased. Make sure important data has been backed up before wiping.

Reveal a recovery key

If an employee is locked out of their encrypted device, you can reveal the recovery key stored in your MDM.

1. Open the device's detail page.
2. Click Reveal Recovery Key.
3. Confirm that you want to view the key.
4. Confirm a second time (this action is audited).

The key is displayed on screen. The type depends on the operating system:

• macOS — FileVault recovery key
• Windows — BitLocker recovery key

Note: Revealing a recovery key is rate-limited and logged for security. Only reveal it when genuinely needed.

MDM status and health

For MDM-managed devices, the Status info and MDM Information cards on the Details tab show:

• MDM — the name of the MDM provider
• Health score — an overall device health rating
• Encryption status — whether disk encryption is enabled
• Firewall status — whether the firewall is active
• OS version — the operating system and version

The Lifecycle tab (only visible for MDM-capable devices) shows a timeline of the device's lifecycle phases, utilisation metrics, and health insights over time.

Good to know

What happens if the device is offline?

MDM actions are queued and will execute when the device comes back online. The action will show as pending until it is confirmed by the MDM provider.

Are MDM actions logged?

Yes. All MDM actions are recorded in the device's Activity tab, including who initiated the action and when.

Can I undo a wipe?

No. A device wipe is permanent and cannot be reversed. The device must be set up from scratch after a wipe.