Lost work laptop or phone: lock it fast and protect company access

TL;DR — If you lose a work laptop or phone, treat it as a security incident immediately: lock or erase the device from your company device-management portal if you have access, then sign out of company accounts from another device and change your password. The single most useful action is to remove the lost device's access before anyone can use saved sessions, email, or authenticator apps on it. Reading time: ~5 min

Goal

When you finish, the lost device is locked or queued for wipe in your company endpoint-management tool, your important work accounts have been signed out or had their sessions revoked, your main password has been changed, and you have the exact details ready for your agency or IT contact to continue the incident response.

Prerequisites

• A second trusted device you can use now: another phone, tablet, or computer with internet access
• Your company email address
• Access to your identity provider (IdP, the system used for sign-in), such as Microsoft 365, Google Workspace, Okta, or similar
• Access to your company device-management portal if your organization gave you self-service access; if not, the security or IT contact method for your agency
• Your mobile number or backup sign-in method if multi-factor authentication (MFA, a second sign-in check) is enabled
• The rough details of the lost device: laptop or phone, brand/model, phone number if applicable, last known location, and the approximate time you noticed it was missing

Steps

Step 1: Confirm whether the device is truly lost

Check the places where the device was last used, then call the phone or ask someone nearby to look for the laptop.

Exact actions:

• Phone: call the number from another phone
• Laptop: check your bag, desk, car, meeting room, and charger location
• If the device may have been stolen, skip searching and move to Step 2 immediately

What you should see when this succeeds: you either recover the device, or you are confident enough to treat it as lost and continue within a few minutes.

Step 2: Lock or erase the device from your provider dashboard

⚠️ If you choose erase/wipe, local files that are not synced to cloud storage may be permanently deleted. If the device is only misplaced in your home or office, use lock first.

Use the dashboard that matches your work account. In your provider's dashboard, use the closest path below:

• Microsoft 365 / Entra / Intune environments: My Account → Devices or Company Portal → Devices → [device name] → Lost device / Wipe / Retire
• Google Workspace environments: Google Account → Security → Your devices → Manage devices → [device] → Sign out; for Android phones also use Find My Device → Secure device
• Apple-managed devices: Find My app or iCloud.com → Find Devices → [device] → Mark As Lost
• If your company uses another endpoint management or EDR (endpoint detection and response, a security tool for company devices) portal, open the device page and choose the literal action labeled Lock, Lost Mode, Retire, or Wipe

If you have no self-service device portal, send this exact message to your agency or IT contact:

Subject: Lost work device - urgent lock/wipe request

My work device is lost and may be at risk.
User: <your name>
Email: <your work email>
Device type: <laptop or phone>
Device model: <if known>
Phone number: <if applicable>
Last known location: <location>
Approximate time noticed missing: <time>
Requested action: lock immediately; wipe if required by policy

What you should see when this succeeds: the device status changes to Lost, Locked, Pending wipe, Retired, or the support contact confirms they have started the action.

Step 3: Revoke sign-ins from the lost device

From a trusted device, sign out the lost device from your work account.

Use the closest path below:

• Microsoft account: myaccount.microsoft.com → Devices → [device] → Remove device and Security info → Sign out everywhere if available
• Google account: myaccount.google.com → Security → Your devices → Manage all devices → [device] → Sign out
• Okta or similar IdP: User dashboard → Settings → Security Methods / Sessions → Revoke sessions or Sign out of other sessions

If your email, chat, VPN, password manager, or source-control service has its own session page, also sign out there from a browser on your trusted device.

What you should see when this succeeds: the lost device no longer appears as an active session, or the page confirms other sessions were signed out.

Step 4: Change your work password

Change the password for the account used on the lost device.

Use the password-change page for your provider:

• Microsoft 365: myaccount.microsoft.com → Password → Change password
• Google Workspace: myaccount.google.com → Security → Password
• Okta or similar IdP: User dashboard → Settings → Change password

Use a new password that is not reused anywhere else.

What you should see when this succeeds: a confirmation message such as Your password was changed and, in many systems, a prompt that other sessions will be signed out.

Step 5: Protect MFA and work apps on the lost phone

If the lost device is a phone, check whether it held your authenticator app, SMS codes, or password manager.

Take the matching action:

• Authenticator app on lost phone: in your IdP, go to Security info or MFA settings and remove the lost phone as a sign-in method
• SMS to lost phone number: contact your mobile carrier and ask them to suspend the SIM or block the line; then update MFA to a different method
• Password manager app on lost phone: from another device, sign in to the password manager web vault and use Log out all devices or Deauthorize device

What you should see when this succeeds: the lost phone no longer appears as an MFA method or trusted device, and your carrier confirms the line is suspended if needed.

Step 6: Report the incident with the exact details security needs

Send a short report to your agency or IT/security contact even if you already locked the device yourself.

Use this exact template:

Subject: Lost work laptop/phone - incident report

I lost a work device and have already taken the actions below.

User: <your name>
Email: <your work email>
Device type: <laptop or phone>
Device model/asset tag: <if known>
Serial number: <if known>
Last known location: <location>
Approximate time noticed missing: <time>
Contains company email: yes/no
Contains authenticator app: yes/no
Contains password manager: yes/no
Actions already taken:
- Device lock/wipe requested at <time>
- Account sessions revoked at <time>
- Password changed at <time>
- Mobile carrier contacted at <time> (if applicable)
Police report number: <if applicable>

What you should see when this succeeds: you receive a ticket number, email acknowledgment, or direct confirmation that the security team has the details.

Verify it works

Check these end-to-end results from your trusted device:

• In your device portal, the device shows Locked, Lost Mode, Pending wipe, Retired, or Wiped
• In your account security page, the lost device is absent from Your devices or marked signed out
• Your new password works, and the old password no longer does
• If the lost item was a phone, the old phone is no longer listed as an MFA method
• Your agency or IT contact confirms the incident is recorded

A simple flow of the response looks like this:

[You] ---- 1. report loss ----> [Device portal / IT]
  |
  | 2. revoke sessions
  v
[Identity provider]
  |
  | 3. change password
  v
[Protected company apps]

Common pitfalls

You wait to see if the device turns up

Mistake: Delaying the report for an hour or more because the device is probably nearby.

Symptom: The device remains signed in to email, chat, cloud storage, or MFA apps during the delay.

Fix: Start Step 2 and Step 3 within minutes, then keep looking for the device after the lock request is submitted.

You only change the password

Mistake: Changing your password but not revoking sessions or locking the device.

Symptom: Some apps stay signed in on the lost device because existing sessions can survive a password change.

Fix: Open your account security page and use the literal action Sign out, Revoke sessions, or Sign out everywhere for the lost device.

You erase a laptop before checking whether files are synced

Mistake: Choosing wipe immediately for a misplaced laptop that may contain unsynced local files.

Symptom: The device is protected, but local documents may be gone permanently.

Fix: Use Lock or Lost Mode first if the device is likely recoverable, then ask IT whether important folders were synced before approving a wipe.

You forget the authenticator app on the lost phone

Mistake: Reporting the phone loss but leaving the old phone registered for MFA.

Symptom: You get locked out later, or the lost phone can still receive approval prompts or codes.

Fix: Remove the lost phone from Security info or MFA settings and add a new method on your replacement device.

You do not suspend the mobile line after losing a phone

Mistake: Assuming account sign-out is enough for a lost phone.

Symptom: SMS-based MFA and calls still go to the lost device's SIM.

Fix: Call your mobile carrier and ask them to suspend the line or block the SIM, then update MFA to an app or hardware key on a new device.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.