Direct answer
Report the loss promptly, identify the device and potentially exposed accounts, follow the organization's incident process and verify the outcome of any authorized remote action.
Record the incident
Capture the device identifier, owner, last known location and time, and whether it was locked or encrypted if known. Notify the security and device-management teams using a trusted channel. Preserve uncertainty rather than assuming the device was stolen or its data was accessed.
Assess accounts and data
Determine what sensitive material and sessions may have been available, including offline data and cached credentials. The incident team can decide whether to revoke sessions, reset credentials or change access based on its playbook. Check encryption and recovery records without disclosing recovery keys.
Coordinate device actions
If management supports a lock, retire or wipe, verify device identity and required authorization, understand the data impact and document the request. An offline device may not receive an action until it reconnects. Check the action state and avoid claiming deletion until the outcome is confirmed.
Reference: Microsoft: Intune device actions.
Separate device and cloud access
A lost laptop might contain an active browser session even if its disk is encrypted. The incident lead should identify affected services and coordinate account and application session revocation with their owners. Record when each action was requested and confirmed; application-owned sessions and offline device actions can have different completion behavior.
Assessment limits
A remote action may not reach an offline device. Encryption reduces some data-at-rest exposure but does not establish that all accounts or cloud data are safe.
Frequently asked questions
Does a submitted wipe prove data was erased?
No. Verify the management action outcome and track devices that remain offline.
Does encryption eliminate the need to report a loss?
No. Report the incident and assess account sessions, data and the actual protection state.
Should a recovery key be pasted into an incident ticket?
No. Keep recovery secrets in the approved restricted system and record only an evidence reference.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.