Wipe a device in Intune.
Get a signed certificate back.
WipeCert connects to your Entra ID tenant, wipes managed devices from inside it, and returns a signed NIST 800-88 certificate for each one. The wipe runs in your tenant. The proof is public.
Intune is an add-on: $129/mo on any paid plan, included with Enterprise.
Intune-managed device
Dell Latitude 5540 · BitLocker on
WipeCert issues the wipe
Protected wipe · tracked to completion
NIST 800-88 certificate
WC-CERT-2026-######
Wipe runs in your tenant · proof is public
This is a real wipe from our lab: queued through Intune, erased on the device, signed, and checked on a public page. The lab disk is virtual, so the record shows the method that ran.
Watch one Intune bare-metal wipe, from the queued job to the certificate check
Recorded in our own lab. Lab device, lab data.
How the automation works
From offboarding ticket to auditor-ready proof.
Five steps, all driven from WipeCert. No manual tracking of which devices have actually been wiped, and no scripts to babysit.
Connect your Entra ID tenant
Approve WipeCert in your own tenant. Guided setup walks your admin through it in a few minutes. WipeCert never asks for access to mail, files or user content, and you can withdraw access at any time.
Sync managed devices
WipeCert pulls your Intune-managed devices and keeps them in sync. Pick the ones to wipe from the dashboard, individually or in bulk.
Queue a certified wipe
Send the erasure from WipeCert. The command runs inside your own tenant against your own devices.
Track it to completion
WipeCert follows each device until the wipe reports done. The dashboard shows pending, wiping, and completed for every device in the batch.
Issue the certificate
On completion, a NIST 800-88 certificate is digitally signed and linked to the Intune device record. Download it or verify it publicly, no login required.
Honest by design
The certificate states what actually happened.
A remote wipe on a BitLocker-encrypted device destroys the keys, which makes the data unrecoverable. WipeCert reads the device's encryption state and certifies the correct NIST 800-88 level. It never claims more than the hardware did.
Encrypted device → Purge
When BitLocker is on, the remote wipe performs a cryptographic erase. The device certifies NIST 800-88 Purge. A protected wipe is also supported for a full drive clean.
Unencrypted device → Clear
Without full-disk encryption, the standard remote wipe certifies NIST 800-88 Clear. For a verified full-disk erase on those devices, use bare-metal erasure below.
After a certified wipe, devices can be re-enrolled through Windows Autopilot for the next user. WipeCert handles the erasure, Autopilot handles the provisioning.
Bare-metal erasure, pushed by Intune itself.
When a remote wipe is not enough, Intune deploys the eraser and reboots the device into a dedicated pre-boot erasure environment (no host OS) that erases the internal disk in full, not just a factory reset. No separate RMM, no bench visit, and the same signed certificate at the end.
Full internal-disk erase
Clears the entire drive, well beyond what a factory reset touches.
Driven from Intune
Intune delivers it and the device reboots straight into the pre-boot erasure environment.
Same certificate standard
Ends in the same signed NIST 800-88 certificate.
Bare-metal is available to Intune customers today. Turn it on for your tenant and it runs on the same signed-certificate pipeline as every other wipe method.
What it costs
Sync Intune-managed devices and trigger MDM remote wipes from WipeCert. Available on Starter, Professional, Business, and White-Label / MSP. Included with Enterprise. At $129/mo ($107.50/mo billed annually), it turns any paid plan into an in-tenant offboarding pipeline. Bare-metal full-disk erasure runs through this same Intune integration, so both remote wipe and full-disk erase are covered by the one add-on. New customers can request a 30-day Intune pilot.