Intune/Autopilot: Last contacted

Question

Hello,

Last week one of our user lost his laptop at our office. He lost the laptop in a public area where anyone can enter. Someone went to the office 2h later but didn't find the laptop.

As we didn't find the laptop the next day, we strongly believe it was stolen. I directly blocked the device in Azure and reset the password of the user Msft365 account.
I tried to locate the laptop with the locate option in Intune but it was unbale to find the device. (the location was disabled on the laptop, i think it is the reason)

Then I decided to use the wipe option in Intune to protect our data. The process was pending for a long time and today I noticed the device was missing in Intune.
I know it is due to the normal wipe action process but how can I be sure the wipe process ended successfully?

After some investigation, we think the laptop could maybe still be in the office or have been stolen by someone in the building. Is it possible to do something to find the laptop? or prove something? All information I have are in autopilot. so I am wondering if I can do something with the serial number, maybe find the mac address somewhere and check on the network etc?

I also see the last contacted field in autopilot, and it says it contacted the laptop today. Does it mean there is still a link with the laptop and I can see it was connected to internet?

Answer 1

@thib Thanks for posting in our Q&A.

As I know, we can use the Locate device action to get the location of a lost or stolen Windows or iOS/iPadOS device on a map. The premise is that the device location must be turned on.

I noticed that we have did the wipe action to protect our company data. The device will reset the next time it connects to the network. Today the device is missing in Intune, normally it means that the wipe action is successful. The laptop disconnected with intune.

As the device is enrolled by autopilot and it has connected to the internet today, we can see the last contacted information in autopilot. Currently If we want to find more information from the laptop, such as mac address or IP address. It is better to create an online support ticket to confirm the wipe action status and check the backstage information to see if we can find them. It is free. Here is the online support link and hope it helpful.
https://learn.microsoft.com/en-us/mem/intune/fundamentals/get-support

Hope this issue will be solved as soon as possible.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.