iOS User Enrollment - Remove device from intune

Question

Hello,

We got such problem. I have iOS devices enrolled to intune using User Enrollment. I have create conditional access policy and deployed it to ios user groups so that users who doesn't enroll they device can't get to the company resource.

The problem.

When i delete ios device from intune. On the device:

1. Deletes management profile;
2. Signs out from company portal and informs user that his device was removed;
3. But if users was logged in outlook, onedrive, teams etc. - he could access company resources.

After 1 hour, if they try to reach company resource -> they receive notification in application that they need to enroll theirs device . So it's means that after deleting ios device from intune, conditional access policy applies only after 1 hour, but no immediately.

Maybe you got some suggestions? Or maybe there something need to be changed in configuration?

Thank you!

Answer 1

The delay could be because of the access token that is valid for an hour. If you want to speed this up, you can try to perform the device wipe which will revoke the data (only corporate data).

Regards,
Eswar
www.eskonr.com

Answer 2

So in my case in iOS User Enrollment i need to use selective wipe?

Because in user enrollment scenario, device cannot be wiped.

Answer 3

You can try the retire option which removes only the corporate data/apps etc. Please read https://learn.microsoft.com/en-us/mem/intune/remote-actions/devices-wipe#retire for more about the retire option.

Thanks,
Eswar

Answer 4

Hello

I used selective wipe on device and then delete it.

Everything runned successfully.