Forum Discussion

Copper Contributor

Jun 03, 2022

Solved

Intune Device Wipe Logs

We recently had a couple of managed iOS devices get wiped by Intune. However I have learned that the Intune Audit Logs don't record wipes. Is this something Intune is looking to introduce? Se...

community

Moe_Kinani
Jun 06, 2022
Hi Richard1069

This makes sense to me now. You don’t find devices information actions in audit logs, as it shows audit log actioned by admins.
You might be able to find those details if you send LOG > IntuneDevices: to Log Analytics and alert via email. This setting sits under Diagnostics Settings as you mentioned, check this url below-
https://docs.microsoft.com/en-us/mem/intune/fundamentals/review-logs-using-azure-monitor

Moe

Richard1069

Copper Contributor

Jun 06, 2022

Thanks again. Yes I have global admin. Ok so it looks like if I do a manual wipe of a device, it records it in the audit logs. However, a wipe initiated by a Configuration Profile - eg. if a user has too many passcode attempts the device is wiped - this is not recorded in the logs.

Moe_Kinani

Bronze Contributor

Jun 06, 2022

Hi Richard1069

This makes sense to me now. You don’t find devices information actions in audit logs, as it shows audit log actioned by admins.
You might be able to find those details if you send LOG > IntuneDevices: to Log Analytics and alert via email. This setting sits under Diagnostics Settings as you mentioned, check this url below-

https://docs.microsoft.com/en-us/mem/intune/fundamentals/review-logs-using-azure-monitor

Moe

Richard1069
Copper Contributor
Jun 06, 2022
Cheers Moe. I will have a look at that.