Microsoft Intune - Wipe Devices

This incident response workflow allows you to wipe one or more devices using Microsoft Intune from a playbook. When using this workflow in a playbook, the user selects which devices to wipe. Supported observables: hostname, serial number, IMEI

Notes:

• Device wipe behavior can vary depending on the device's operating system/platform. To adjust some of this behavior, update the properties of the "Microsoft Intune - Wipe Device" activity.
• If multiple devices are returned for a given observable, the observable will be skipped. The workflow only attempts to wipe a device if a single matching device is found in Intune.

Target: Microsoft Intune

Steps:

• Detect the start type and extract the supported observables
• Check if any supported observables were found (if not, end the workflow)
• For each observable:
  • Search for a matching device
  • Extract the device ID
  • Attempt to wipe the device and update the workflow result