Quick answer
Tell your IT provider immediately and change your password. IT can remotely wipe just the work data and revoke your active sign-ins so no one can get into email or files. Then remove the lost device from your account and re-register MFA on your new phone. If company data may be exposed, report it.
WHY SPEED MATTERS
Cut off access before anyone uses it.
Even with a screen lock, a lost phone is a live door into your work email, calendar and files until access is revoked. The good news: your workplace can shut that door remotely and quickly. If the device was enrolled in a management system like Microsoft Intune, IT can wipe just the company data — leaving your personal photos and apps alone — and revoke every active session so the missing phone stops working within minutes. Your job is to raise the alarm fast and lock your account.
WHAT TO DO NOW
Work through these straight away.
- Tell IT immediatelyCall or message your IT provider or administrator now — don't wait to see if the phone turns up. They can act far faster than you can from a lost handset. If it may have been stolen, also report it to police for your records and insurance.
- Change your work passwordFrom a computer or another trusted device, change your Microsoft 365 password. This alone starts closing off access on the missing phone.
- Ask IT to revoke your sessionsHave your administrator revoke your active sign-ins in Microsoft Entra. This signs your account out everywhere — including the lost phone — so old logins can't keep working after the password change.
- Have the work data wiped remotelyIf the phone was managed, IT can run a selective wipe from Intune that removes company email, apps and data only. For a fully company-owned phone they may do a full wipe. Either way, the business data comes off.
- Remove the device from your accountOnce wiped and revoked, the old phone should be removed from your sign-in methods and device list so it can't be used to approve anything or hold onto access.
- Re-register MFA on your new phoneSet up Microsoft Authenticator on the replacement phone and register it at aka.ms/mfasetup (IT may reset your MFA first). Test a sign-in to confirm approvals now land on the new device.
- Report if company data is at riskIf sensitive client or company information may have been exposed, tell your manager and IT so it can be assessed. In Australia, some data breaches must be reported — your IT provider can advise on obligations.
Watch for follow-up scams. Whoever has your phone or number may try to trick you or a colleague into handing over a password or approving a sign-in — by text, call or email. Never approve an MFA prompt you didn't personally trigger, and confirm any urgent "IT" request through a known number. Losing the phone is bad enough; don't let it become an account takeover too.
