Our iphones are enrolled with DEP and we're using Systems Manager.
I've had a user come to me today asking why her iphone has factory reset. I've logged into Systems Manager and I can't see an event listed which tells me that an erase device (or selective wipe) has been logged against the device.
How do I find out why this iphone has been factory reset? It's a bit of a mystery to me and it was an awkward moment explaining that the data (esp. photos) on the device has been lost.
If this was initiated from the device end, the user should have received an email alert from Apple stating that there was some sort of iCloud/Find My Phone account activity change if they were logged in with a personal account.
While it's certainly possible that this occurred from the Meraki end, my experience has been that someone with physical access to the device erased it (intentionally, or not).