Forum Discussion
Intune Device Wipe Logs
Hi Richard1069
This makes sense to me now. You don’t find devices information actions in audit logs, as it shows audit log actioned by admins.
You might be able to find those details if you send LOG > IntuneDevices: to Log Analytics and alert via email. This setting sits under Diagnostics Settings as you mentioned, check this url below-https://docs.microsoft.com/en-us/mem/intune/fundamentals/review-logs-using-azure-monitor
Moe
Moe_Kinani Hi Moe, thanks for that. The devices were wiped just a few days ago. Do you know if that particular log needs to be specified in Tenant Admin -> Diagnostic Settings?
https://docs.microsoft.com/en-us/mem/intune/fundamentals/monitor-audit-logs#audit-logs-for-intune-workloads
Moe
- Thanks again. Yes I have global admin. Ok so it looks like if I do a manual wipe of a device, it records it in the audit logs. However, a wipe initiated by a Configuration Profile - eg. if a user has too many passcode attempts the device is wiped - this is not recorded in the logs.
Hi Richard1069
This makes sense to me now. You don’t find devices information actions in audit logs, as it shows audit log actioned by admins.
You might be able to find those details if you send LOG > IntuneDevices: to Log Analytics and alert via email. This setting sits under Diagnostics Settings as you mentioned, check this url below-https://docs.microsoft.com/en-us/mem/intune/fundamentals/review-logs-using-azure-monitor
Moe
- Cheers Moe. I will have a look at that.