Forum Discussion

Richard1069's avatar
Richard1069
Copper Contributor
Jun 03, 2022
Solved

Intune Device Wipe Logs

We recently had a couple of managed iOS devices get wiped by Intune. However I have learned that the Intune Audit Logs don't record wipes.   Is this something Intune is looking to introduce?   Se...
community
  • Moe_Kinani's avatar
    Moe_Kinani
    Jun 06, 2022

    Hi Richard1069 

     

    This makes sense to me now. You don’t find devices information actions in audit logs, as it shows audit log actioned by admins.
    You might be able to find those details if you send LOG > IntuneDevices: to Log Analytics and alert via email. This setting sits under Diagnostics Settings as you mentioned, check this url below-

    https://docs.microsoft.com/en-us/mem/intune/fundamentals/review-logs-using-azure-monitor

     

    Moe

     

Moe_Kinani's avatar
Moe_Kinani
Bronze Contributor
Jun 04, 2022

Hi Richard1069,

 

You should be able to see that in the Audit Logs. Navigate to Tenant Administration- Audit Logs - Filter by Device - Wipe ManagedDevice. Screenshot attached for more clarity.

 

Hope this helps!

Moe

  • Richard1069's avatar
    Richard1069
    Copper Contributor
    Jun 04, 2022

    Moe_Kinani thanks for reply. However I have been to that location in audit logs and there's no log for a wipe. It's strange because I can filter to find a managed wipe as you suggest, but nothing shows up. 

    • Moe_Kinani's avatar
      Moe_Kinani
      Bronze Contributor
      Jun 04, 2022

      Is it older than one year? I can see the wipe actions for the phones I’ve done 8 months ago.

      Moe

      • Richard1069's avatar
        Richard1069
        Copper Contributor
        Jun 05, 2022

        Moe_Kinani Hi Moe, thanks for that. The devices were wiped just a few days ago. Do you know if that particular log needs to be specified in Tenant Admin -> Diagnostic Settings?

Resources