How to fix intune wifi policy misconfiguration?

Hi Bobby, I completely understand the panic here locking yourself out of a new kiosk iPad with a bad Wi-Fi profile, and you're definitely not the first admin to hit it. Let's get you sorted out.

The situation you're in is actually a known limitation of MDM, if the device can't reach the internet, it can't receive any remote commands from Intune including a wipe. The command will just sit in a queue until the device reconnects. So remote wiping it from the Intune console won't work right now. You need to break the cycle locally.

Follow the step-by-step recovery path for the same.

Step 1: Get the iPad out of the Recovery Mode Loop:

The recovery loop usually happens when a restore attempt gets interrupted or the firmware download fails. The fix is almost always a full restore via a computer, not just an "Update" attempt.

1. Put the iPad back into DFU mode properly**.** Connect it to your Mac or PC with a USB cable. Quickly press Volume Up, then Volume Down, then hold the Top button until the screen goes black. Keep holding Top and the Volume Down button for about 5 seconds, then release only the Top button while continuing to hold Volume Down for another 10 seconds. Your computer should detect the device in DFU mode (the iPad screen will stay black).
2. Open Finder (Mac) or the Apple Devices app / iTunes (Windows). You should see a message saying the iPad is in recovery mode and needs to be restored. Click Restore, not Update. This will download a fresh copy of iPadOS and wipe the device. And if the restore keeps failing, try a different USB cable and a different USB port. Also make sure your Mac or iTunes is fully updated. A failed restore is often a cable or software version issue, not a device problem.
3. If Finder/iTunes still can't detect it, you can try a third-party recovery tool like ReiBoot or iMyFone Fixppo. These have a one-click "Exit Recovery Mode" feature that can sometimes break the loop without a full restore. But honestly, a clean restore through Finder is the most reliable path.

Once the restore completes, the iPad will be wiped and you'll see the initial setup screen.

Step 2: Stop it from re-enrolling in Intune:

If this iPad was added to Apple Business Manager (ABM) or Apple School Manager (ASM) and assigned to Intune, a simple factory reset won't be enough. It will automatically re-enroll in Intune during setup and you'll be right back where you started.

So before you go through the setup assistant, do this:

Log into Apple Business Manager (or Apple School Manager, whichever your organization uses).

Find the device under the Devices section.

Unassign it from the MDM server. In ABM, select the device, click the menu in the upper right, and choose "Unassign Device Management". In ASM, the wording is similar — you're removing the MDM assignment for that specific serial number.

If the device isn't in ABM/ASM, it was likely enrolled manually. In that case, a factory reset through Finder will remove the management profile entirely, and it won't come back.

Once it's unassigned in ABM/ASM, you can go through the iPad setup. It will no longer pull down the Intune enrollment during activation, and you'll have a clean, unmanaged iPad.

Step 3: Fix the Wi-Fi profile before you re-enroll:

Before you put this iPad (or the others) back into Intune, fix the configuration that caused this in the first place:

Don't lock the device to a single SSID in a way that prevents fallback. In your Wi-Fi profile, make sure you're not disabling "Auto-Join" for other networks or setting it as the only allowed network unless you're absolutely certain the device will always be in range.

Add a backup SSID to the profile if possible, so the device has a fallback if the primary network is unavailable.

Test the profile on a spare device before rolling it out to your kiosk fleet.

Consider a "grace period" — you can configure the Wi-Fi profile to not apply immediately, giving you a window to intervene if something goes wrong.