Lost, Stolen or Compromised Device Workflow
The ten-step guided incident: mark, assess, revoke sessions, lock, retire, rotate, validate, evidence, controls, report.
Updated Aug 20, 2026Product 2026.99 minMSP operator, Internal IT
Overview
The ten-step guided incident: mark, assess, revoke sessions, lock, retire, rotate, validate, evidence, controls, report.
Documentation status
This article is a concise reference. A fully expanded guide for “Lost, Stolen or Compromised Device Workflow” is scheduled in the documentation roadmap; the steps below are accurate for the current product version.
How it works
- Configuration lives in the workspace and is scoped to the tenant.
- Collectors and connectors produce evidence on a cadence; results update control states automatically.
- Every state change is recorded as an append-only observation.
Next steps
Use the contextual Help menu on the related product page to jump back here, or open the related playbooks listed below.
Error codes covered
Related playbooks
Was this helpful?