flow for wiping DEP managed devices in Intune

Question

I'm currently trying to create a workflow that has been requested by our business. One of our IT departments is responsible for wiping devices. This can be done through Intune, but I would like to make this possible in Adaxes as well. I already have custom command that works, based on the user context and a given serial number. Now Instead of using the User Context, I need to be able to wipe by only giving the serial number. The IT department doesn't always know to wich person this specific devices is bound to.

Requirements

• Initiator puts in a serial number
• custom command will check for the device and send wipe command
• limit scope to specific target users (filter on department)

I also need to take in consideration that searching all the devices first and then filtering the specific device may take some time to complete. What would be a good solution in this case? Working with a scheduled task and populate a business unit? I attached the existing script that has been created as reference

Import-Module Microsoft.Graph.Authentication
Import-Module Microsoft.Graph.Identity.SignIns
Import-Module Microsoft.Graph.DeviceManagement.Actions

# Get the Azure AD access token
$token = $Context.CloudServices.GetAzureAuthAccessToken("https://graph.microsoft.com")
$token = $token | ConvertTo-SecureString -AsPlainText -Force
Connect-MgGraph -AccessToken $token

# Get Microsoft 365 Object ID
try
{
    $objectId = [Guid]$Context.TargetObject.Get("adm-O365ObjectId")
}
catch
{
    $Context.LogMessage("The user %fullname% doesn't have a Microsoft 365 account.", "Warning")
    return
}

#process the user
$user = Get-MgUser -UserId $objectId
$upn = $user.userprincipalname
$Context.LogMessage("$($UPN)", "information")

#get all devices of the user
$devices = Get-mgdevicemanagementManagedDevice -filter "UserPrincipalName eq '$UPN'"

#filter iOS DEP devices
$serial = "%param-serialnumber%"
$iOSDevices = $devices | where-Object{ $_.SerialNumber -eq "$serial"}
$Context.LogMessage("Device ID: $($iOSdevices.AzureADDeviceID), Device Name: $($iOSdevices.DeviceName), Manufacturer: $($iOSdevices.Manufacturer)", "Information")


#if no devices found
if ($iOSDevices.Count -eq 0){
    $Context.LogMessage("No Device found for this serial number $($Serial)", "warning")
}

Else{
    #get the object ID
    $IntuneDeviceID = $iOSDevices.AzureAdDeviceId
    $iOSDevices = get-MgDevice -filter "deviceID eq '$IntuneDeviceID'"
    $iOSDeviceID = $iOSDevices.Id

    # Wipe the device
    try
        {
            $params = @{
            keepEnrollmentData = $false
            keepUserData = $false
            persistEsimDataPlan = $false
        }

            Clear-MgDeviceManagementManagedDevice -ManagedDeviceId $IntuneDeviceID -BodyParameter $params
            $Context.LogMessage("Wipe command sent to device with Serial $($serial)", "Warning")
        }
    catch
        {
            $Context.LogMessage("Failing to send Wipe command. Contact Core Services.", "Warning")
            return
        }
}

Comments

Hello Alex,

Unfortunately, that is not something we can assist you with as there is no such built-in functionality in Adaxes. Using a script is the only option and that is something that fully relies on Microsoft functionality. We were not able to find scripts like the one you need.