Perform a remote wipe on a mobile phone in Exchange Online
Your users carry sensitive corporate information in their pockets every day. If one of them loses their mobile phone, your data can end up in the hands of another person. If one of your users loses their mobile phone, you can use the Exchange admin center (EAC) or Exchange Online PowerShell to wipe their phone clean of all corporate and user information.
Note
This topic also provides instructions for how to use Outlook on the web (formerly known as Outlook Web App) to perform a remote wipe on a phone. The user must be signed in to Outlook on the web to perform a remote wipe.
What do you need to know before you begin?
Estimated time to complete: 5 minutes.
You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "Mobile devices" entry in the Feature permissions in Exchange Online topic.
For information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard shortcuts for the Exchange admin center.
Note
Prior to EAS v16.1, remote wipe would perform a device-level wipe, restoring the device to factory conditions. With EAS v16.1 and later, EAS also supports account-only remote wipe. In order for this to work, the client must support the EAS v16.1 protocol. If the client doesn't support v16.1, the wipe will fail and an error will be given.
Caution
Exchange ActiveSync v16.1 supports two different remote wipe processes: A Wipe Data remote wipe and also an Account Only Remote Wipe Device remote wipe. There are important differences between how Outlook responds and how native mail apps on iOS and Android respond to these different wipe commands.
Outlook for iOS and Outlook for Android support only the Wipe Data command, which wipes only data within Outlook. The Outlook app will reset and all Outlook email, calendar, contacts, and file data will be removed, but no other data is wiped from the device. The Account Only Remote Wipe Device command is therefore redundant and is not supported by Outlook for iOS or Android.
However, if a native iOS or Android mail app is connected to Exchange and receives a Wipe Data command from Exchange ActiveSync, all data on the device will be wiped, including photos, personal files, and so on.
If a native iOS or Android mail app is connected to Exchange and receives an Account Only Remote Wipe Device command from Exchange ActiveSync, only the native mail app's Exchange ActiveSync mail, calendar, and account data are wiped.
These commands are designed to destroy data. Exercise caution when using them.
After the remote wipe command is requested by the administrator, the wipe happens within seconds of the Outlook app's next connection to Exchange.
Since Outlook for iOS and Android appears as a single mobile device association under a user's mobile devices in Exchange, a remote wipe command will remove data and delete sync relationships from all devices running Outlook (iPhone, iPad, Android) associated with that user.
Tip
Having problems? Ask for help in the Exchange forums. Visit the forums at Exchange Online or Exchange Online Protection.
Use the classic EAC to wipe a user's phone
Note
The classic EAC will be fully deprecated by September 2022. For more information, see Deprecation of the classic Exchange admin center in WW service.
You can use the classic EAC to wipe a user's phone or cancel a remote wipe that has not yet completed.
In the EAC, navigate to Recipients > Mailboxes.
Select the user, and under Mobile Devices, choose View details.
On the Mobile Device Details page, select the lost mobile device, and then select Wipe Data (or Account Only Remote Wipe Device if desired).
Select Save.
Use Exchange Online PowerShell to wipe a user's phone
You can use the Clear-MobileDevice cmdlet in Exchange Online PowerShell to wipe a user's phone.
The following command wipes the device named WM_TonySmith and sends a confirmation message to admin@contoso.com.
Clear-MobileDevice -Identity WM_TonySmith -NotificationEmailAddresses "admin@contoso.com"
If the device connects to Exchange using a mail app other than Outlook, you can use the following command to wipe only the mail app's Exchange ActiveSync mail, calendar, and account data and leave all other data on the device intact:
Clear-MobileDevice -AccountOnly -Identity WM_TonySmith -NotificationEmailAddresses "admin@contoso.com"
The -AccountOnly switch has no effect on Outlook devices because an account-only remote wipe is the only type of wipe that is supported by Outlook. See Clear-MobileDevice for more information.
Use Outlook on the web to wipe a user's phone
In Outlook on the web, select the Settings icon.
Click on View All Outlook settings.
Click General, and then select Mobile devices.
Select the mobile phone.
Click or tap the Wipe Device icon (or the Account Only Remote Wipe Device icon if desired).
How do you know this worked?
There are several ways to verify that the remote wipe completed.
Run the Clear-MobileDevice cmdlet with the -NotificationEmailAddresses parameter configured. A message will be sent to the supplied email address when the remote wipe has completed.
In the EAC, check the status of the mobile device. The status will change from Wipe Pending to Wipe Successful.
In Outlook on the web, check the status of the mobile device. The status will change from Wipe Pending to Wipe Successful.