iphones has reset itself automatically

[Suleyman Ali]

We have setup a few tenants with VPP tokens and apple business manager integration with intune.  Using ABM integration with intune is excellent to provision iphones - expecially when you purchase these iphones anywhere and using apple configurator to prepare.

We have had three calls in the last 1-2 weeks where users have woke up and they found that their apple iphone seems to have factory reset.  They are prompted with Hello!  either the user restored fromm backup or went through the process of setting up the iphones again. The three cases are as follows:

iphone 7, ios 14.X, provisioned via ABM/Intune, corporate apple id

iphone 12, ios 14.X, provisioned via ABM/Intune, corporate apple id

iphone 7, ios 14.X, enrolled via company portal app, non-corporate apple id

none of them entered the pin incorrectly to initiate the automatic reset

are there any log files we can review?

[#2]

@Suleyman Alihave your figured out what's causing this? I have the same issue for a user whose device i manage. 

[#3]

no, we have not figured this out. I have reported to the Azure Intune team.

[#4]

I have seen this when users just type their PIN code in incorrectly for x number of times. Are you sure this isn't the case?

[#5]

no, this is not the case. Its possible it can be accidental, however, two of the users have said that it was like this in the morning. So nothing can be sure without reviewing the log files (if its possible)

[#6]

You can always double check the Intune logs to ensure no admin wiped the device. Apart from that, there isn't much to do unfortunately, as the logs on the local device have been wiped.

[#7]

yes, we checked that shortly after they reported and nothing there. We are looking to enhance the logging using the disagnostic logs where it would stream to a log collection service (like azure analytics)

[#8]

oh wow, whilst posting this earlier, another user has escalated the same issue. This time the user has said that it was due to an update.

[#9]

@Suleyman Ali I see where you said this behavior may be associated with an upgrade? Was this an IOS upgrade?

[#10]

@Suleyman Ali 

Having been working with Apple DEP (now ABM) for the last 3 years, I can tell you that I have not seen any instance of a user reporting a device wipe / factory reset after an iOS update, Self-installed or MDM console pushed.

I can tell you that after an auto-update install for iOS, the user can get to the Hello screen, and go through some of the setup screens, but it always gets them back to their device with their apps.

Did the user go through the same 'SetUp' screens you have configured in InTune for your ABM / InTune integration?

If you have configured 6 items to 'Don't Skip' for the InTune MDM Profile and the user did not receive all 6, the device was not fully wiped.

Or, even simpler, did they see the 'Remote Management' screen?

Yes: The device was wiped.
No: The device was not wiped.

A full device wipe will reset everything, and the phone will start fresh and check with Apple Servers to 'Activate' the device.

If only 3 users out of a large deployment are experiencing this, I generally find that the reporting users did something different, or are not reporting the issue correctly. It may seem to have been wiped, but it wasn't really wiped.

Answer to your questions about the logs: 

Logs to review: for MDM console issued device wipe, you already mentioned that you checked. An Admin initiated wiped will show the admin username and the 'MDM Break' entry in the log on the day that the user reported it happened.

Also, does the Enrollment date in the console match the reported 'wipe' date? 

Device logs: Given that you are using ABM and AC2, I assume these are company owned devices. If you can get physical access to the devices, you can install Xcode on your Mac.

Open Xcode
Click on Window
Click on Device and Simulators
Allow the device to Trust the Mac (enter passcode on device)
Click on View Logs

If you see logs with a date prior to the date the user reported the wipe, then, the device was not wiped.

Hope this helps to first of all, determine if the devices were actually wiped.

[#11]

Xcode is an excellent tip. After looking at this carefully and no more wipes since. we have looked at the devices historical inventory / issues and we noticed that the devices in question all had their screen replaced via a company called ismash.

So we increased the configuration where the device gets wiped after so many unsuccessful tries. we increased to 11 tfrom 5.

we are going to keep an eye on it.