Lost, Stolen or Compromised Mobile Device
A business-owned phone or tablet with corporate accounts is lost, stolen or shows a failed integrity check — like the clinician iPhone reported lost with an active Microsoft 365 session.
- Trigger
- User report, provider lost-mode flag, or a failed Play Integrity / jailbreak signal on a device with corporate access.
- Risk
- Until sessions are revoked and the device is locked or retired, anyone holding the device may reach mail, files and line-of-business apps. Encryption and passcode reduce — but do not eliminate — exposure; valid refresh tokens are the fastest path to data.
Prerequisites
- A connected provider (Intune, Android Management API, Jamf, Kandji) with remote-action permission
- Identity provider access to revoke sessions (Entra ID or Google Workspace)
- Knowledge of the device's management mode — supervised/fully managed devices support more actions than work-profile or registered-only devices
Recommended fix
- Mark the device lost/stolen/compromised in AssurIQ; trust drops to Blocked immediately.
- Assess what the device could reach: cloud apps, data scopes and sensitive managed apps (ePHI, consumer financial, payments).
- Revoke cloud sessions and refresh tokens first — this closes the fastest path to data.
- Lock the device (Lost Mode on supervised iOS; lock / work-profile lock elsewhere) and request location where supported.
- Retire corporate data (retire, or remove work profile). Factory reset only for corporate-owned fully managed/supervised devices.
- Rotate the device certificate and any shared credentials the device held.
Validation
- Trust re-evaluation shows Blocked/Retired with no allowed cloud access relationships
- Identity provider shows no active sessions for the device
- Provider confirms lock/retire command succeeded
Rollback and recovery
- If the device is recovered before retire, disable Lost Mode and re-evaluate trust; sessions must still be re-established on a compliant device.
- Retire and wipe are not reversible; re-provision through ADE / zero-touch.
Evidence generated
- Incident record with timestamped steps and actor
- Command receipts from the provider and identity provider
- Before/after trust states and cloud access relationships
- Incident evidence item (hashed, versioned) linked to AIQ-MOB-006
Related controls
Related docs
- Lost, Stolen or Compromised Device WorkflowThe ten-step guided incident: mark, assess, revoke sessions, lock, retire, rotate, validate, evidence, controls, report.
- Mobile Device Trust ModelTrusted, At risk, Noncompliant, Unknown, Blocked: how signals (OS, patch level, encryption, passcode, integrity, check-in, data-protection policy, app governance) combine with confidence.
- Platform Capability MatrixWhich data-protection and lifecycle controls are supported on supervised vs unsupervised iOS, fully managed, work-profile and dedicated Android — and why unsupported items are evidence gaps, not failures.