What happens when an AirWatch managed device is lost or stolen

A lost or stolen work device creates two problems at once: the organisation may lose physical control of the hardware, and an unauthorised person may gain access to business information. An AirWatch-managed endpoint gives IT teams a way to respond centrally, rather than relying entirely on the employee finding the device or contacting the police.

The exact response depends on the device type, its operating system, connectivity, enrolment status and the security policies applied to it. A corporate iPhone, a Windows laptop and an employee-owned Android handset may follow different workflows, even when they are managed through the same broader enterprise mobility environment.

The employee should report the incident as soon as possible through the company’s service desk, security hotline or manager. In Australia, that may mean contacting a support team in Sydney, Melbourne, Brisbane or Perth during local business hours, while larger organisations may provide a 24-hour incident channel for travelling staff.

AirWatch can then help administrators locate the device’s last known status, restrict access, protect corporate applications and begin recovery or disposal procedures. The platform does not remove the need for sound identity management, device encryption, backups and staff training, but it can shorten the time between a loss and meaningful security action.

The first response after a device goes missing

The employee should first confirm whether the device is genuinely lost, rather than simply misplaced in a taxi, café or meeting room. A quick call to the handset, a check with venue staff and a review of the last known location can sometimes recover it without escalating the incident. If theft is suspected, the employee should avoid confronting anyone and should report it to the police where appropriate.

The organisation’s help desk will usually record the user, device identifier, asset number, time of loss, location and information held on the device. Details matter: losing a locked tablet with no local business data presents a different risk from losing an unlocked laptop used to access customer records or administrator accounts.

IT administrators can identify whether the endpoint is online and communicating with the management console. If it is connected, commands such as remote lock, passcode enforcement or enterprise wipe may be delivered quickly. If it is offline, the action may remain queued until the device reconnects, so other controls should be applied immediately.

The user’s access should also be reviewed. Administrators may revoke sessions, reset credentials, disable certificates and require multifactor authentication again. This is particularly important if the missing device used saved browser sessions, email synchronisation, virtual private network access or single sign-on to cloud services.

How AirWatch helps protect business data

A managed device can be placed into a restricted state through the AirWatch console, depending on the operating system and the organisation’s configuration. A remote lock prevents ordinary use, while a device passcode can be changed or strengthened. Some devices also support a message or contact number on the lock screen, which may help an honest finder return the hardware.

The more serious option is an enterprise wipe or full device wipe. An enterprise wipe removes corporate profiles, applications, certificates and managed content while attempting to preserve an employee’s personal information. A full wipe restores the device to a factory-like state and is generally considered when the device is stolen, unrecoverable or contains a high level of sensitive information.

The decision should reflect the device’s ownership model. A company-issued phone can often be wiped comprehensively under an employment policy. A personally owned handset enrolled under a bring-your-own-device arrangement requires greater care, because removing personal photographs, banking apps or private messages may create legal, employee-relations and privacy concerns.

Administrators should also inspect application-level protections. Containerised email, managed document stores and per-app virtual private network settings can limit exposure even if the rest of the handset remains usable. Organisations comparing different endpoint management approaches can also consult Windows UEM resources when reviewing controls for Windows laptops and desktops.

What happens to the user’s accounts and access

Removing data from the hardware is only part of the response. A stolen device may still have active sessions with Microsoft 365, Google Workspace, customer relationship systems, collaboration tools or line-of-business applications. Security teams should invalidate refresh tokens, revoke sessions and assess whether passwords or authentication factors were stored locally.

Digital certificates deserve particular attention. A managed device may use certificates for Wi-Fi, email, VPN or application authentication. Revoking the relevant certificate can prevent the missing endpoint from continuing to present itself as a trusted corporate device. New credentials can then be issued after the employee’s identity is verified.

The organisation should review logs for unusual activity after the estimated loss time. Relevant signals include impossible travel, repeated sign-in failures, access from unfamiliar countries, bulk downloads and attempts to register another device. A user travelling between Melbourne and Singapore, for example, may generate legitimate location changes, so investigation should consider travel records and normal working patterns rather than relying on a single alert.

If personal information may have been accessed, the incident should be assessed under the organisation’s privacy and breach-response procedures. Australian businesses may need to consider the Privacy Act and the Notifiable Data Breaches scheme, depending on the information involved and the likelihood of serious harm. The OAIC, customers, insurers or regulators may need to be involved according to the circumstances.

Recovery, replacement and investigation

If the device is recovered, it should not automatically return to normal use. IT staff can check whether it remained locked, examine management records and confirm that no tampering or unauthorised account changes occurred. A compromised device may need to be reset, re-enrolled and patched before it is returned to an employee.

If the hardware cannot be recovered, the asset register should be updated and any mobile service or eSIM associated with it should be suspended or replaced. The telecommunications provider may block the handset identifier where applicable. Police reports, insurer notifications and procurement records can support a replacement claim and preserve an accurate audit trail.

The replacement device should receive the same or stronger controls as the original. These may include encryption, a minimum passcode length, automatic screen locking, operating system updates, application allow-listing and restrictions on removable storage. Enrolment should be completed before corporate applications and data are restored.

For remote and field workers, replacement can involve practical Australian considerations. A technician working across regional New South Wales may have limited connectivity, while a mining or construction employee may use rugged equipment in areas with intermittent coverage. Procedures should therefore include offline contingencies, spare devices and a clear way to contact support when the managed endpoint cannot connect.

Actions that reduce the impact of a lost device

Prevention works best when it combines device controls with simple employee instructions. Staff should know exactly where to report a missing endpoint, what information to provide and when to contact emergency support. Policies should distinguish between a misplaced device, suspected theft and a device that may have been exposed to a hostile party.

Regular testing also exposes gaps before an incident occurs. Security teams can check whether a remote lock reaches each supported platform, whether an enterprise wipe removes corporate data, whether certificates are revoked and whether alerts reach the right responders. Testing should cover laptops, phones, tablets, shared devices and personally owned equipment.

Practical controls and response habits include:

The most effective policy is one employees can follow under pressure. A short reporting process, clear privacy boundaries and regular reminders are more useful than a document that is technically comprehensive but difficult to find. Australian offices can reinforce the process through induction, annual security training and brief reminders before major travel periods such as the Christmas and summer holiday season.

A lost endpoint should be treated as a security incident until its exposure is understood. AirWatch management can support rapid containment, but it works alongside encryption, identity controls, monitoring, privacy assessment and sound operational decisions. Once the device is locked or wiped, the organisation should preserve records of what happened, what commands were issued and which accounts were secured.

Review the organisation’s AirWatch or VMware endpoint policies now, confirm that remote actions work across the device fleet, and make sure every employee knows the reporting path. A tested response can protect business data, reduce disruption and give staff a clear way forward when a phone, tablet or laptop disappears.