Lost or stolen device

Act quickly, but do not wipe first. A wiped device can never be located or recovered.

In the first five minutes

Open Devices and find the device by serial number or the person's group.
Note the last check-in time and open Location history. This tells you whether the device is still online and roughly where it was.
Select Lost mode. The device locks and shows your message on the screen.

Write a message with a way to return it and no personal details:

This device belongs to Springfield High School. Please call 0800 123 4567.

In the first hour

Ask the person to retrace their steps. Most "stolen" devices are in a bag, a car, or a staff room.
Watch Locations for a new position. Any new report means the device is on and online.
If the device holds sensitive information and recovery looks unlikely, decide on a wipe with whoever is responsible for data protection in your organisation.

If it is genuinely stolen

Report it to the police and get a crime reference number.
Record the loss internally — serial number, who held it, what was on it, and what you did.
If personal data was on the device, tell your data protection lead today. Many countries have a legal deadline measured in days.
Wipe the device. Use Wipe for an organisation-owned device, or Selective wipe for a personal device so only work data is destroyed.

A wipe only takes effect when the device next connects to the internet. If it is offline the command waits in the queue, and if it is never switched on again it never runs. That is why lost mode and a quick decision matter more than the wipe itself.

If it is found

Still in lost mode → turn lost mode off and hand it back.
Already wiped → enrol it again from scratch: Android, Windows.

Afterwards

Check the Audit log and save the entries for this device. They show exactly what was done and when, which is what an insurer or an investigator will ask for.