We have an Apple School Manager and Microsoft Intune managed iPad that has been missing for some time and according to Intune, it last communicated on 01/05/2025 at 18:33. Our management policies are currently based on the name of the iPad, so if it matches "ENG-iOS-01" then it receives specific restrictions. However, this iPad has been reset and the name has defaulted to "iPad", thus not receiving policies. I have pushed a lost mode command via Intune, but I still have to wait for the device to come back online to do this and locate device appears to only work when the device is already in lost mode. We cannot use FindMy, as our ASM is federated with M365 and FindMy becomes unavailable.
I can still see the device in Intune, though the amount of information stored about the device is extremely limited. I can see the device name, device ID, key hardware specs and installed apps (TikTok and YouTube - which makes me believe either a student has stolen it or a member of staff has taken it and their children are using it).
I cannot seem to find a way to get any more information, such as last IP address the device used, if anyone signed in via an Entra-enabled authentication method (emails, Sparx, etc). I've looked through the sign in logs and I cannot seem to filter for this device.
How can I get more information?
↧