Agentbeamdocs

Start here

MDM / Getting startedDevice managementOne place to understand your Apple and Windows fleet, deliver configuration, and request device actions.MDM / Getting startedSet up your workspaceRequest MDM access, check platform readiness, and get your first managed device into inventory.Agent CLI / Getting startedAgent CLI overviewUnderstand agent activity locally, scan the files your assistants use, and connect shared workspace controls when needed.Agent CLI / Getting startedCLI quickstartInstall Beam, capture a first event, and open your local activity dashboard.Agent CLI / Getting startedConnect a workspacePair your machine through the browser or an enrollment code, then verify identity and policy synchronization.
↑ ↓ to navigate · Enter to openEsc to close
Website Open dashboard
Device management/Device response
Device response

Lock, wipe & response channels

Choose the correct response path and understand exactly what each high-impact action can do.

On this page

Beam exposes remote actions only when the device, provider, role, and deployment configuration support them. There are two paths: provider actions through Fleet and Beam response through a separately bound Apple or Windows channel. A bound device uses Beam response rather than Fleet's premium lock/wipe endpoints.

Compare the channels

ChannelLock behaviorWipe behavior
Beam response: MacApple DeviceLock with an operator-supplied six-digit recovery PINRestricted to verified Apple silicon/T2 devices ready for Erase All Content and Settings
Beam response: iPhone/iPadApple DeviceLock; does not enable Lost Mode or location trackingApple EraseDevice with appropriate device-enrollment rights
Beam response: WindowsDisconnects active console/RDP sessions; users can sign in againRequests the OS's standard Windows reset
Fleet provider actionsDepends on platform and Fleet capabilities; iOS/iPadOS lock uses Lost ModeProvider-managed erase with its own prerequisites and licensing

Fleet Premium is separately required for the Fleet lock/wipe path. Fleet Windows lock/unlock additionally needs scripts enabled; the provided installer builders do not turn scripts on automatically. Beam response has separate provisioning requirements and does not remove the need for Fleet inventory.

Review and submit an action

  1. Open the device and verify its exact identity, platform, and response channel.
  2. Confirm that you have current owner or administrator access.
  3. Read the action description. High-impact operations require deployment enablement, the exact device name, and password reauthentication.
  4. For Beam response, enter an operational reason. Wipe additionally requires ERASE ALL DATA and per-device wipe enablement.
  5. For a Mac lock, store a fresh six-digit PIN in your organization's vault before entering it. Beam does not escrow the PIN or provide remote unlock for this channel.
  6. Submit once, preserve the operation ID, and verify the provider/device outcome.
A request moves from recorded intent to dispatch and provider acceptance, then requires separate device confirmation. Unknown outcomes require investigation.
Provider acceptance and confirmed device outcome are separate stages.

Handle offline and uncertain devices

Apple commands accepted by NanoMDM may execute when the device comes online. They do not expire in Beam and cannot be cancelled here. Only uncollected Windows response commands can be cancelled; they expire after ten minutes if uncollected.

Unknown or unconfirmed results block further Beam response actions on that device. Inspect worker receipts, OS state, or the NanoMDM queue with your operator. Do not clear evidence or submit a new wipe to resolve uncertainty.

Validate the channel first

Real device behavior depends on enrollment, OS support, and provider configuration. Test lock, recovery, offline delivery, and wipe on disposable hardware before fleet activation. An OS acknowledgement does not certify secure sanitization of every disk.

Keep exploring

Explore the docs