When a staff member calls to say their laptop was stolen from a car or left on a train, the first hour matters more than anything you do the following week. A written lost laptop Intune response playbook turns a panicked phone call into a sequence anyone on the IT team can follow. This article gives you that playbook, based on the controls Microsoft Intune and Microsoft Entra ID already provide.
Before anything goes missing: what must already be true
A response plan only works if the groundwork is in place. If any of these are missing, fix them now, because you cannot turn them on after the device is gone.
BitLocker is on and the recovery key is escrowed to Microsoft Entra ID. Without full-disk encryption, a stolen laptop is a data breach the moment someone removes the drive.
The device is enrolled in Intune and has checked in recently. Remote actions only reach devices that are managed and online.
Windows LAPS is configured so every laptop has a unique local administrator password stored in your directory.
Conditional Access requires a compliant device, so a device you mark as lost or disable stops getting access to company data.
You know who has the authority to approve a wipe. If you use Intune Multi Admin Approval for device actions, a second admin must approve the wipe, so make sure two people are reachable.
The first 30 minutes
Speed matters most for cutting off access. The device itself is usually locked and encrypted. The bigger risk is an open browser session, a cached token or a password written on a sticky note in the laptop bag.
Record the facts. User, device name, serial number, when and where it was last seen, whether it was powered on, and whether anything else was taken with it (phone, security key, notebook with passwords).
Revoke the user’s sessions. In the Microsoft Entra admin center, open the user and select Revoke sessions. This invalidates refresh tokens so apps have to sign in again.
Reset the password if there is any chance it was stored with the laptop or the device was unlocked when lost. Re-register MFA methods if a phone or security key went with it.
Disable the device object in Entra ID. In Microsoft Entra admin center > Devices > All devices, select the device and choose Disable. A disabled device cannot authenticate to Entra ID, which blocks device-based Conditional Access.
Check encryption status in Intune under Devices > All devices > [device] > Recovery keys and the encryption report. Confirm BitLocker was on. This decides whether you are dealing with an inconvenience or a reportable incident.
Locate, retire or wipe: choosing the right Intune action
Intune gives you several device actions. They are not interchangeable, and some are not available on every platform.
Action
What it does
When to use it
Locate device
Shows approximate location on a map (Windows needs location services enabled)
Device may be recoverable, for example left in a taxi or office
Lost Mode (supervised iOS/iPadOS)
Locks the device and shows a custom message and phone number on screen
Company iPhone or iPad that might be returned
Retire
Removes company data, apps and settings, leaves personal data
Personal or BYOD devices, not stolen corporate laptops
Wipe
Factory reset, removes all data and settings
Corporate device confirmed stolen or not recoverable
Wipe, and continue to wipe even if device loses power
Protected wipe that overwrites free space and resumes after power loss
High-risk theft of a corporate Windows device
BitLocker key rotation
Issues a new recovery key
A recovery key was shared, for example read out over the phone
Two warnings from Microsoft’s documentation are worth repeating. First, the protected wipe option can leave some devices unable to start again, so use it only on corporate devices you do not expect to reuse without a rebuild. Second, any action only runs when the device next checks in with Intune. If the thief never connects it to the internet, the wipe stays pending. That is why encryption and session revocation come first: they protect you whether or not the wipe ever lands.
Note that Intune’s remote lock action is not available for Windows devices. For Windows, your levers are revoking access, disabling the device, and wiping.
The next 24 hours
Decide on the wipe. If there is no realistic chance of recovery within a day, issue the wipe from Intune admin center > Devices > All devices > [device] > Remove data > Wipe. If Multi Admin Approval protects device actions, the second admin approves and the requestor selects Complete.
Review sign-in logs. In Entra ID, filter sign-ins for the user and the device over the period since it went missing. Look for successful sign-ins from unfamiliar locations or the device after the loss time.
Check Microsoft Defender XDR for alerts or activity on the device, and use device isolation if it comes online and you have not yet wiped it.
Rotate secrets the device held. The Windows LAPS password is unique to the device, but rotate any shared credentials, Wi-Fi keys or VPN certificates that were stored on it.
Get the user working. Issue a replacement through Windows Autopilot so it is ready in an hour, not a day. With OneDrive Known Folder Move, their Desktop and Documents come back automatically.
Reporting and close-out
The technical steps are only part of the job. For healthcare, legal, finance and accounting firms, a lost device can trigger notification duties.
Get a police report reference for theft. Insurers almost always ask for it.
Assess whether regulated data was on the device and whether it was encrypted. Encryption status is often the deciding factor in whether a loss is reportable. Involve your compliance lead or legal counsel.
Notify your cyber insurer within the policy’s required window.
Once the device is written off, remove it from Intune and Entra ID, and deregister it from Windows Autopilot so it cannot re-enroll into your tenant if it turns up later in the wrong hands.
Write a short incident note: timeline, actions taken, what worked, what was slow. Update this playbook with anything you learned.
Make the playbook usable
A playbook in a SharePoint folder nobody can find is not a playbook. Print the first 30 minutes on one page. Put it in the helpdesk runbook. Run a tabletop exercise once a year: pick a real device, walk through every step in the portal without actually wiping, and time it. In the reviews I run, the first rehearsal usually reveals one missing permission or one person who did not know the escalation path.
Give the user an easy way to report quickly, too. A lost laptop reported on Monday morning after a Friday night theft has had a full weekend of exposure.
Frequently asked questions
Can Intune wipe a laptop that is turned off?
The wipe is queued and runs the next time the device connects to the internet and checks in with Intune. If it never connects, the wipe never runs, which is why BitLocker encryption and revoking the user’s sessions are the most important first steps.
Should I retire or wipe a stolen company laptop?
Wipe. Retire removes only company data and leaves the rest of the device intact, which is designed for personal devices. A stolen corporate laptop should be fully wiped, and then removed from Intune, Entra ID and Windows Autopilot.
Can I remotely lock a Windows laptop with Intune?
No. Intune’s remote lock action is available for iOS/iPadOS, macOS and Android, not Windows. For Windows, revoke the user’s sessions, disable the device in Microsoft Entra ID and issue a wipe.
Would your team know what to do if a laptop went missing tonight? Book a free Microsoft 365 security assessment and we will check that encryption, Conditional Access and remote actions are ready before you need them.
When a staff member calls to say their laptop was stolen from a car or left on a train, the first hour matters more than anything you do the following week. A written lost laptop Intune response playbook turns a panicked phone call into a sequence anyone on the IT team can follow. This article gives you that playbook, based on the controls Microsoft Intune and Microsoft Entra ID already provide.
Before anything goes missing: what must already be true
A response plan only works if the groundwork is in place. If any of these are missing, fix them now, because you cannot turn them on after the device is gone.
The first 30 minutes
Speed matters most for cutting off access. The device itself is usually locked and encrypted. The bigger risk is an open browser session, a cached token or a password written on a sticky note in the laptop bag.
Microsoft Entra admin center > Devices > All devices, select the device and choose Disable. A disabled device cannot authenticate to Entra ID, which blocks device-based Conditional Access.Devices > All devices > [device] > Recovery keysand the encryption report. Confirm BitLocker was on. This decides whether you are dealing with an inconvenience or a reportable incident.Locate, retire or wipe: choosing the right Intune action
Intune gives you several device actions. They are not interchangeable, and some are not available on every platform.
Two warnings from Microsoft’s documentation are worth repeating. First, the protected wipe option can leave some devices unable to start again, so use it only on corporate devices you do not expect to reuse without a rebuild. Second, any action only runs when the device next checks in with Intune. If the thief never connects it to the internet, the wipe stays pending. That is why encryption and session revocation come first: they protect you whether or not the wipe ever lands.
Note that Intune’s remote lock action is not available for Windows devices. For Windows, your levers are revoking access, disabling the device, and wiping.
The next 24 hours
Intune admin center > Devices > All devices > [device] > Remove data > Wipe. If Multi Admin Approval protects device actions, the second admin approves and the requestor selects Complete.Reporting and close-out
The technical steps are only part of the job. For healthcare, legal, finance and accounting firms, a lost device can trigger notification duties.
Make the playbook usable
A playbook in a SharePoint folder nobody can find is not a playbook. Print the first 30 minutes on one page. Put it in the helpdesk runbook. Run a tabletop exercise once a year: pick a real device, walk through every step in the portal without actually wiping, and time it. In the reviews I run, the first rehearsal usually reveals one missing permission or one person who did not know the escalation path.
Give the user an easy way to report quickly, too. A lost laptop reported on Monday morning after a Friday night theft has had a full weekend of exposure.
Frequently asked questions
Can Intune wipe a laptop that is turned off?
The wipe is queued and runs the next time the device connects to the internet and checks in with Intune. If it never connects, the wipe never runs, which is why BitLocker encryption and revoking the user’s sessions are the most important first steps.
Should I retire or wipe a stolen company laptop?
Wipe. Retire removes only company data and leaves the rest of the device intact, which is designed for personal devices. A stolen corporate laptop should be fully wiped, and then removed from Intune, Entra ID and Windows Autopilot.
Can I remotely lock a Windows laptop with Intune?
No. Intune’s remote lock action is available for iOS/iPadOS, macOS and Android, not Windows. For Windows, revoke the user’s sessions, disable the device in Microsoft Entra ID and issue a wipe.
Microsoft’s guide to wiping devices with Intune explains each wipe option in detail. If you want this playbook built for your tenant and tested, our Intune managed service includes incident response for lost devices, and our endpoint security baseline puts BitLocker and LAPS in place first. Healthcare practices can also see our healthcare IT services.
Would your team know what to do if a laptop went missing tonight? Book a free Microsoft 365 security assessment and we will check that encryption, Conditional Access and remote actions are ready before you need them.