This is a post that got me curious as to whether it could be done, well using Google to check his facts I came across this glimmer of light that says yes, it can be tracked:
View the Audit logs: You can see who started a Retire/Wipe by going to Tenant administration > Audit logs and checking the Initiated By column. If there's no entry, the device's user initiated the action
This is absolutely fantastic news because if it’s in the audit log, it can also be extracted through a power shelf script that uses API calls connect connecting to Graph.
This is good news because that means you can track these actions and report on them not only for mobile devices, but also Windows laptops at the same time, lets get coding.
Pre-requisites Requirements
You need to ensure you have the Graph API installed and registered for this to work, this can be completed with the command:
Install-Module Microsoft.Graph -Force -AllowClobber
Import-Module Microsoft.Graph
This should download and install all the modules required for this command to work effectively
Script : WipeReport.ps1
# App registration details
$tenantId = "<tenant_id>"
$clientId = "<client_id>"
$clientSecret = "<secret>"
# Get token
$body = @{
Grant_Type = "client_credentials"
Scope = "https://graph.microsoft.com/.default"
Client_Id = $clientId
Client_Secret = $clientSecret
}
Write-Verbose "Getting access token..." -Verbose
$response = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" -Method POST -Body $body
$token = $response.access_token
#Write-Verbose "Connecting to Microsoft Graph..." -Verbose
#Connect-MgGraph -AccessToken $token
# Convert token to SecureString
$secureToken = ConvertTo-SecureString $token -AsPlainText -Force
# Connect using SecureString token
Connect-MgGraph -AccessToken $secureToken
# Get the date from 30 days ago (maximum audit log retention)
$startDate = (Get-Date).AddDays(-30).ToString('yyyy-MM-dd')
$endDate = (Get-Date).ToString('yyyy-MM-dd')
Write-Verbose "Checking audit logs from $startDate to $endDate" -Verbose
# Initialize arrays for different device types
$mobileWipeReport = @()
$windowsWipeReport = @()
Write-Verbose "Fetching audit logs for wipe and reset commands..." -Verbose
$auditLogs = Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $startDate and (activityDisplayName eq 'Wipe device' or activityDisplayName eq 'Reset device')" -Verbose
Write-Verbose "Found $($auditLogs.Count) audit log entries" -Verbose
foreach ($log in $auditLogs) {
Write-Verbose "Processing audit log entry from $($log.ActivityDateTime)" -Verbose
# Get device details
$deviceId = $log.TargetResources.Id
Write-Verbose "Getting device details for ID: $deviceId" -Verbose
$device = Get-MgDeviceManagementManagedDevice -ManagedDeviceId $deviceId -ErrorAction SilentlyContinue
# Skip if device not found
if (-not $device) {
Write-Verbose "Device not found, skipping..." -Verbose
continue
}
Write-Verbose "Getting user details for device owner and initiator..." -Verbose
# Get user who owned the device
$deviceUser = Get-MgUser -UserId $device.UserId -ErrorAction SilentlyContinue
# Get admin who initiated wipe
$initiatedBy = Get-MgUser -UserId $log.InitiatedBy.User.Id -ErrorAction SilentlyContinue
Write-Verbose "Creating report entry for device: $($device.DeviceName)" -Verbose
# Create report object
$reportEntry = [PSCustomObject]@{
WipeDate = $log.ActivityDateTime
DeviceName = $device.DeviceName
DeviceModel = $device.Model
DeviceOS = $device.OperatingSystem
OSVersion = $device.OsVersion
DeviceOwner = if ($deviceUser) { "$($deviceUser.DisplayName) ($($deviceUser.UserPrincipalName))" } else { "Unknown" }
WipeInitiatedBy = if ($initiatedBy) { "$($initiatedBy.DisplayName) ($($initiatedBy.UserPrincipalName))" } else { "Unknown" }
ActionType = $log.ActivityDisplayName
Status = $device.DeviceActionStatus
SerialNumber = $device.SerialNumber
LastSyncDateTime = $device.LastSyncDateTime
}
# Sort into appropriate report based on OS
if ($device.OperatingSystem -match 'Windows') {
Write-Verbose "Adding to Windows report" -Verbose
$windowsWipeReport += $reportEntry
} else {
Write-Verbose "Adding to Mobile report" -Verbose
$mobileWipeReport += $reportEntry
}
}
Write-Verbose "Preparing to export reports..." -Verbose
# Export to separate CSV files
$dateStamp = Get-Date -Format 'yyyyMMdd'
$mobileExportPath = "Intune_Mobile_Wipe_Report_$dateStamp.csv"
$windowsExportPath = "Intune_Windows_Wipe_Report_$dateStamp.csv"
Write-Verbose "Exporting mobile device report to $mobileExportPath" -Verbose
$mobileWipeReport | Export-Csv -Path $mobileExportPath -NoTypeInformation
Write-Verbose "Exporting windows device report to $windowsExportPath" -Verbose
$windowsWipeReport | Export-Csv -Path $windowsExportPath -NoTypeInformation
# Display summary on screen
Write-Host "`nMobile Device Wipes:"
Write-Host "Total wipes found: $($mobileWipeReport.Count)"
Write-Host "Report exported to: $mobileExportPath"
$mobileWipeReport | Format-Table -AutoSize
Write-Host "`nWindows Device Wipes/Resets:"
Write-Host "Total wipes/resets found: $($windowsWipeReport.Count)"
Write-Host "Report exported to: $windowsExportPath"
$windowsWipeReport | Format-Table -AutoSize
Write-Verbose "Script completed successfully" -Verbose
The script should run like this, you can see here that zero wipes have been detected for laptops and mobiles:
This will produce the file you need for the report to be run, which in this example is run separately with another script, so if you have data to add to the report then you can use the script below to produce a nice HTML report that is mobile friendly.
When this reporter creation is run you should then get an output file in graphical format as below, obviously this is "made up" data:
Trouble running the script?
If when you try to run the script you get a sea of red errors then you may need to refresh your Graph permissions and modules, to get this to work you need to follow these instructions:
- Close ALL PowerShell windows and applications using PowerShell
- Open a new PowerShell window as Administrator
- Run the script below
Once this script has completed you can then run this command to reinstall Graph and import it:
Install-Module Microsoft.Graph -Force -AllowClobber
Import-Module Microsoft.Graph