Please confirm:
Problem Statement
"Remove all Mobile Devices" removes no data. Remove-CIPPMobileDevice calls
Remove-MobileDevice, deleting the ActiveSync partnership only — synced mail, calendar,
and contacts stay on the mobile device. In tenants without Intune MDM or MAM (App Protection), that
leaves corporate mail on an ex-employee's personal phone indefinitely. Clear-MobileDevice
solves it and isn't exposed in CIPP. The current option name implies otherwise.
Proposed behavior — and why it can't factory reset
New option Wipe Mobile Devices, separate from Remove all Mobile Devices:
enumerate Get-MobileDevice -Mailbox <upn>, call Clear-MobileDevice -Identity <id> -AccountOnly on every device.
-AccountOnly unconditional; the unqualified call is never constructed in the function:
- Native iOS/Android mail apps - EAS: wipes the Exchange account's mail/calendar/contacts only.
- Outlook iOS/Android:
-AccountOnly — account-only is the only wipe Outlook
supports. App reset either way.
- Requires EAS v16.1. Older clients error out. Fails closed, no fallback to device wipe.
Ref: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/exchange-activesync/remote-wipe-on-mobile-phone#use-exchange-online-powershell-to-wipe-a-users-phone
Cmdlet: https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/clear-mobiledevice
Ordering constraint
Wipe must be first in $TaskOrder and must precede
Remove-CIPPMobileDevice, which destroys the delivery channel. If both selected:
wipe → check DeviceWipeAckStatus via Get-MobileDeviceStatistics → remove.
Benefits for MSPs
Closes a data-retention gap in every non-Intune tenant. Replaces a manual EXO PowerShell
step that gets skipped with an auditable one.
Value or Importance
This step is mostly overlooked from MSP offboarding procedures presently, leaving a gap in protecting corporate data.
PowerShell Commands (Optional)
$Devices = Get-MobileDevice -Mailbox $UserEmail
foreach ($Device in $Devices) {
Clear-MobileDevice -Identity $Device.Identity -AccountOnly `
-NotificationEmailAddresses $AdminEmail -Confirm:$false
}
Please confirm:
Problem Statement
"Remove all Mobile Devices" removes no data.
Remove-CIPPMobileDevicecallsRemove-MobileDevice, deleting the ActiveSync partnership only — synced mail, calendar,and contacts stay on the mobile device. In tenants without Intune MDM or MAM (App Protection), that
leaves corporate mail on an ex-employee's personal phone indefinitely.
Clear-MobileDevicesolves it and isn't exposed in CIPP. The current option name implies otherwise.
Proposed behavior — and why it can't factory reset
New option Wipe Mobile Devices, separate from Remove all Mobile Devices:
enumerate
Get-MobileDevice -Mailbox <upn>, callClear-MobileDevice -Identity <id> -AccountOnlyon every device.-AccountOnlyunconditional; the unqualified call is never constructed in the function:-AccountOnly— account-only is the only wipe Outlooksupports. App reset either way.
Ref: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/exchange-activesync/remote-wipe-on-mobile-phone#use-exchange-online-powershell-to-wipe-a-users-phone
Cmdlet: https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/clear-mobiledevice
Ordering constraint
Wipe must be first in
$TaskOrderand must precedeRemove-CIPPMobileDevice, which destroys the delivery channel. If both selected:wipe → check
DeviceWipeAckStatusviaGet-MobileDeviceStatistics→ remove.Benefits for MSPs
Closes a data-retention gap in every non-Intune tenant. Replaces a manual EXO PowerShell
step that gets skipped with an auditable one.
Value or Importance
This step is mostly overlooked from MSP offboarding procedures presently, leaving a gap in protecting corporate data.
PowerShell Commands (Optional)