In our business I get frequently the question why it’s not possible to do a selective wipe on Azure AD Joined devices. For many of my customers this is an issue because a Windows 10 Mobile is Azure AD Joined when a Work account is added to the mobile device. Let me describe the case.
Azure AD Join and MDM auto enrollment are enabled with Intune and Azure AD Premium. When a Windows 10 Mobile is started for the first time (OOBE) it is possible to “Sign in with a work account” to join Azure AD and auto enroll in Intune. (https://technet.microsoft.com/nl-nl/itpro/windows/manage/join-windows-10-mobile-to-azure-active-directory#how-to-join-windows-10-mobile-to-azure-ad). When a Windows Mobile device is configured this way Single Sign On works for Mail, Calendar, Edge and the Business Store, which is great. But when the Selective Wipe option is initiated from Intune it does nothing with the MDM registered device. Only a Full Wipe works.
On a personal device when adding a work/school account (Settings > Accounts > Your email and accounts > Add work or school account) it has the same behavior.
When first registering a device in Intune (Settings > Accounts > Work Access > Enroll into Device Management) and then add a Work/School account it is possible to do a selective wipe. In this scenario Single Sign On for Mail, Calender and the Business Store doesn’t work.
Above picture is the message when initiating a retire/wipe of a device.
This issue is by design, I know, however multiple customers would like a great user experience (Single Sign On) and the ability to have the management capabilities such as Selective Wipe. I would be very nice to add the possibility to do a selective wipe on Azure AD Joined devices. Many of our customers are ask for this feature because when a personal device is enrolled a full wipe is necessary to unroll the device in Intune.
Please vote up the User Voice Request –