starred/CIPP

Fork 0

mirror of https://github.com/KelvinTegelaar/CIPP.git synced 2026-04-25 16:26:09 +03:00

[GH-ISSUE #4903] [Feature Request]:Off-boarding Wizard option-Account Only Remote Wipe Device #2304

New issue

Closed

opened 2026-03-02 13:51:15 +03:00 by kerem · 2 comments

kerem commented

2026-03-02 13:51:15 +03:00

Owner

Originally created by @shinomen on GitHub (Nov 3, 2025).
Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/4903

Please confirm:

I have searched existing feature requests (open and closed) and found no duplicates.
**me or my organization is currently an active sponsor of the product at the $99,- level.

Problem Statement

When off-boarding users there is currently an option that says "remove all mobile devices" but it's not clear if that is doing a remote data wipe on the device. It would be a great feature to include the option to do an "Account Only Remote Wipe Device" for all mobile devices when off-boarding a user.

Benefits for MSPs

This feature would improve security by removing company data from a device as part of the off-boarding process.

Value or Importance

It's critical to prevent left over residual data from remaining on a users mobile device when they are no longer part of the organization.

PowerShell Commands (Optional)

ChatGPT says:

<# 
.SYNOPSIS
Account-only remote wipe for all mobile devices on a single mailbox.

.NOTES
- Requires Exchange Online PowerShell (Connect-ExchangeOnline).
- "AccountOnly" = remove org mail/calendar/contacts from the device (no full device wipe).
- Works for EAS partnerships; Outlook iOS/Android honors selective wipe as well.
#>

param(
    [Parameter(Mandatory=$true)]
    [string]$UserPrincipalName,

    # Set -DryRun to see what would be wiped without sending commands.
    [switch]$DryRun
)

# 1) Connect (no-op if you’re already connected)
try {
    if (-not (Get-Module -ListAvailable -Name ExchangeOnlineManagement)) {
        throw "ExchangeOnlineManagement module not found. Install-Module ExchangeOnlineManagement"
    }
    if (-not (Get-ConnectionInformation)) {
        Connect-ExchangeOnline -ShowBanner:$false | Out-Null
    }
} catch {
    Write-Error $_.Exception.Message
    break
}

# 2) Get all device partnerships on the mailbox
$devices = Get-EXOMobileDevice -Mailbox $UserPrincipalName -ResultSize Unlimited |
    Sort-Object DeviceType, DeviceModel

if (-not $devices) {
    Write-Host "No mobile devices found for $UserPrincipalName."
    return
}

Write-Host "Found $($devices.Count) devices for $UserPrincipalName.`n"

# 3) Issue Account-only wipe to each device
$results = foreach ($d in $devices) {
    $info = [ordered]@{
        User               = $UserPrincipalName
        Identity           = $d.Identity
        DeviceType         = $d.DeviceType
        DeviceModel        = $d.DeviceModel
        DeviceOS           = $d.DeviceOS
        AccessState        = $d.DeviceAccessState
        WipeRequestSent    = $false
        Error              = $null
    }

    if ($DryRun) {
        $info.WipeRequestSent = $false
        [pscustomobject]$info
        continue
    }

    try {
        # Fire the selective wipe (account-only)
        Clear-MobileDevice -Identity $d.Identity -AccountOnly -Confirm:$false
        $info.WipeRequestSent = $true
    }
    catch {
        $info.Error = $_.Exception.Message
    }

    [pscustomobject]$info
}

$results | Format-Table -AutoSize

# 4) (Optional) Quick verification snapshot
Write-Host "`nVerification snapshot (wipe request/ack where available):`n"
$verify = foreach ($d in $devices) {
    try {
        $stats = Get-EXOMobileDeviceStatistics -Identity $d.Identity -ErrorAction Stop
        [pscustomobject]@{
            Identity              = $d.Identity
            DeviceModel           = $d.DeviceModel
            DeviceOS              = $d.DeviceOS
            LastSuccessSync       = $stats.LastSuccessSync
            DeviceWipeRequestTime = $stats.DeviceWipeRequestTime
            DeviceWipeAckStatus   = $stats.DeviceWipeAckStatus
            DeviceWipeAckTime     = $stats.DeviceWipeAckTime
        }
    } catch {
        [pscustomobject]@{
            Identity              = $d.Identity
            DeviceModel           = $d.DeviceModel
            DeviceOS              = $d.DeviceOS
            LastSuccessSync       = $null
            DeviceWipeRequestTime = $null
            DeviceWipeAckStatus   = "Unknown"
            DeviceWipeAckTime     = $null
        }
    }
}
$verify | Format-Table -AutoSize

Originally created by @shinomen on GitHub (Nov 3, 2025). Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/4903 ### Please confirm: - [x] **I have searched existing feature requests** (open and closed) and found no duplicates. - [x] **me or my organization is currently an active sponsor of the product at the $99,- level. ### Problem Statement When off-boarding users there is currently an option that says "remove all mobile devices" but it's not clear if that is doing a remote data wipe on the device. It would be a great feature to include the option to do an "Account Only Remote Wipe Device" for all mobile devices when off-boarding a user. ### Benefits for MSPs This feature would improve security by removing company data from a device as part of the off-boarding process. ### Value or Importance It's critical to prevent left over residual data from remaining on a users mobile device when they are no longer part of the organization. ### PowerShell Commands (Optional) ChatGPT says: ``` <# .SYNOPSIS Account-only remote wipe for all mobile devices on a single mailbox. .NOTES - Requires Exchange Online PowerShell (Connect-ExchangeOnline). - "AccountOnly" = remove org mail/calendar/contacts from the device (no full device wipe). - Works for EAS partnerships; Outlook iOS/Android honors selective wipe as well. #> param( [Parameter(Mandatory=$true)] [string]$UserPrincipalName, # Set -DryRun to see what would be wiped without sending commands. [switch]$DryRun ) # 1) Connect (no-op if you’re already connected) try { if (-not (Get-Module -ListAvailable -Name ExchangeOnlineManagement)) { throw "ExchangeOnlineManagement module not found. Install-Module ExchangeOnlineManagement" } if (-not (Get-ConnectionInformation)) { Connect-ExchangeOnline -ShowBanner:$false | Out-Null } } catch { Write-Error $_.Exception.Message break } # 2) Get all device partnerships on the mailbox $devices = Get-EXOMobileDevice -Mailbox $UserPrincipalName -ResultSize Unlimited | Sort-Object DeviceType, DeviceModel if (-not $devices) { Write-Host "No mobile devices found for $UserPrincipalName." return } Write-Host "Found $($devices.Count) devices for $UserPrincipalName.`n" # 3) Issue Account-only wipe to each device $results = foreach ($d in $devices) { $info = [ordered]@{ User = $UserPrincipalName Identity = $d.Identity DeviceType = $d.DeviceType DeviceModel = $d.DeviceModel DeviceOS = $d.DeviceOS AccessState = $d.DeviceAccessState WipeRequestSent = $false Error = $null } if ($DryRun) { $info.WipeRequestSent = $false [pscustomobject]$info continue } try { # Fire the selective wipe (account-only) Clear-MobileDevice -Identity $d.Identity -AccountOnly -Confirm:$false $info.WipeRequestSent = $true } catch { $info.Error = $_.Exception.Message } [pscustomobject]$info } $results | Format-Table -AutoSize # 4) (Optional) Quick verification snapshot Write-Host "`nVerification snapshot (wipe request/ack where available):`n" $verify = foreach ($d in $devices) { try { $stats = Get-EXOMobileDeviceStatistics -Identity $d.Identity -ErrorAction Stop [pscustomobject]@{ Identity = $d.Identity DeviceModel = $d.DeviceModel DeviceOS = $d.DeviceOS LastSuccessSync = $stats.LastSuccessSync DeviceWipeRequestTime = $stats.DeviceWipeRequestTime DeviceWipeAckStatus = $stats.DeviceWipeAckStatus DeviceWipeAckTime = $stats.DeviceWipeAckTime } } catch { [pscustomobject]@{ Identity = $d.Identity DeviceModel = $d.DeviceModel DeviceOS = $d.DeviceOS LastSuccessSync = $null DeviceWipeRequestTime = $null DeviceWipeAckStatus = "Unknown" DeviceWipeAckTime = $null } } } $verify | Format-Table -AutoSize ```

kerem

2026-03-02 13:51:15 +03:00

closed this issue
added the
enhancement

no-priority

no-activity

not-assigned
labels

kerem commented

2026-03-02 13:51:16 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Nov 14, 2025):

This issue is stale because it has been open 10 days with no activity. We will close this issue soon. If you want this feature implemented you can contribute it. See: https://docs.cipp.app/dev-documentation/contributing-to-the-code . Please notify the team if you are working on this yourself.

@github-actions[bot] commented on GitHub (Nov 14, 2025): This issue is stale because it has been open 10 days with no activity. We will close this issue soon. If you want this feature implemented you can contribute it. See: https://docs.cipp.app/dev-documentation/contributing-to-the-code . Please notify the team if you are working on this yourself.

kerem commented

2026-03-02 13:51:16 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Nov 20, 2025):

This issue was closed because it has been stalled for 14 days with no activity.

@github-actions[bot] commented on GitHub (Nov 20, 2025): This issue was closed because it has been stalled for 14 days with no activity.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/CIPP#2304

No description provided.

Rows
Columns