A lost company phone or tablet can quickly become more than an asset-management problem.

The device may still provide access to business applications, customer information, employee records, job cards, delivery information, photographs, documents, email or communication platforms.

For South African businesses operating across branches, warehouses, vehicles, client sites and field locations, the speed of the response matters.

The longer a lost or stolen device remains outside the organisation's control, the greater the potential security and operational risk.

This is where MDM remote lock and wipe capabilities can help.

Mobile Device Management (MDM) can give authorised IT teams the ability to remotely secure managed devices when they are lost, stolen or otherwise outside an authorised user's control.

Depending on the device, operating system, ownership model, enrolment method and MDM configuration, administrators may be able to:

• Remotely lock a device
• Remove company-managed data
• Remove a managed work profile
• Remotely wipe a device
• Review device and compliance status
• Confirm the device's last connection to the MDM platform
• Apply security actions
• Support the organisation's lost-device response

The objective is not simply to provide IT with a “wipe button.”

A good MDM strategy gives the business a controlled way to decide when a device should be locked, when company data should be removed and when a full wipe may be appropriate.

MDM South Africa helps organisations improve mobile device visibility, security and control through practical mobile device management software for distributed and mobile workforces.

Quick Answer: What Are MDM Remote Lock and Remote Wipe?

MDM remote lock allows an authorised administrator to remotely restrict access to a managed mobile device, while remote wipe removes some or all data from the device depending on its ownership, operating system and enrolment configuration.

Remote lock is generally appropriate when a device may still be recovered.

Remote wipe or selective work-data removal may be considered when a device is confirmed stolen, unlikely to be recovered or presents a significant information-security risk.

Important: MDM does not guarantee that a lost device can be recovered or successfully wiped. Remote commands depend on factors such as device enrolment, configuration, power, connectivity and the capabilities of the device and MDM platform.

What Is MDM Remote Lock?

Remote lock is an MDM security capability that allows an authorised administrator to send a command that restricts normal access to a managed device without physically having the device.

It can provide an important first response when a company phone or tablet has gone missing.

Remote lock may be appropriate when:

• A device has been misplaced
• The device may still be recovered
• Theft has not been confirmed
• The device is temporarily outside the user's control
• IT needs time to assess the situation
• A shared device cannot be accounted for
• A company-owned device has not been returned

The advantage of remote lock is that the organisation may be able to reduce immediate access risk without immediately deleting the contents of the device.

This can be important when there is still a reasonable chance of recovery.

However, remote lock should not be treated as the entire lost-device response.

The organisation may still need to assess application access, review active accounts or sessions, determine what information could be exposed and decide whether further action is required.

What Is MDM Remote Wipe?

Remote wipe allows an authorised administrator to send a command that removes managed information or erases a managed device.

Exactly what happens depends on the device and how it has been enrolled.

Depending on the configuration, a wipe-related action may:

• Remove a managed work profile
• Remove company-managed applications
• Remove managed company data
• Remove organisational settings
• Factory-reset a company-owned device
• Erase most or all data from the device

Remote wipe may be considered when:

• A device has been confirmed stolen
• Recovery is considered unlikely
• Sensitive company information may be exposed
• The device is believed to be compromised
• A company-owned device has not been returned
• The organisation determines that continued access presents an unacceptable risk

A wipe should normally be governed by a documented approval process.

Deleting information from a device can have operational, privacy and evidentiary consequences, particularly when personally owned devices or important business information are involved.

Remote Lock vs Remote Wipe vs Work-Data Removal

These terms are sometimes used interchangeably, but they describe different actions.

The correct action depends on factors including:

• Device ownership
• Enrolment model
• Information sensitivity
• Likelihood of recovery
• Device connectivity
• Applications being accessed
• Internal security policy
• Privacy requirements

This distinction is particularly important where organisations manage a mixture of company-owned and personally owned devices.

Should You Lock or Wipe a Lost Company Device?

There isn't one correct action for every incident.

A useful decision framework is:

The device is temporarily misplaced

Consider: Remote lock.

If the employee believes the device is nearby or likely to be recovered quickly, locking it can reduce immediate access risk while the organisation investigates.

The device is likely to be recovered

Consider: Remote lock + access review.

Review the applications and information accessible from the device while recovery efforts continue.

The device contains company and personal information

Consider: Selective work-data removal where the device, enrolment model and MDM platform support it.

A full device wipe may have privacy implications where a personally owned device is involved.

The device has been confirmed stolen

Consider: Lock + risk assessment + access revocation + remote wipe where appropriate.

The exact sequence should follow the organisation's approved lost-device policy.

The device may expose sensitive information

Consider: Escalate the incident promptly.

The organisation may need to revoke application access and consider work-data removal or remote wipe depending on the risk.

The device is offline

A remote command may not execute immediately.

The organisation should not simply wait for the device to reconnect. Relevant account access and active sessions should also be assessed.

Important: Remote Wipe Is Not the Same as Access Revocation

This is an important distinction.

MDM primarily helps organisations manage the device.

Identity and access-management controls help organisations manage the user's access to applications and services.

A lost device may have authenticated access to systems such as:

• Email
• Microsoft 365 or Google Workspace
• CRM platforms
• ERP systems
• Cloud storage
• Communication platforms
• Customer portals
• Operational applications
• Industry-specific business systems

Locking a phone does not necessarily terminate every authenticated cloud session.

Similarly, a remote wipe command may remain pending if the device is offline.

Businesses should therefore use MDM alongside appropriate identity and access controls.

Depending on the incident, that may include:

• Session revocation
• Account disablement
• Credential resets
• Application access restrictions
• Multi-factor authentication
• Access reviews

Device security and account security are related, but they are not the same thing.

What Happens If the Lost Device Is Offline?

This is one of the most important limitations of remote device actions.

A remote lock or wipe command generally needs to reach the managed device.

If the device is:

• Powered off
• Out of mobile coverage
• Disconnected from Wi-Fi
• Damaged
• Unable to communicate with the MDM service

the command may not execute immediately.

Depending on the platform and configuration, the command may remain pending until the device reconnects.

This is why organisations should not build their entire lost-device security strategy around remote wipe.

Existing protections such as screen lock, strong authentication, encryption where supported, application security and account controls remain important.

If the device cannot receive an MDM command, the organisation should also consider whether access to relevant business systems needs to be revoked independently.

Company-Owned Devices vs BYOD: Why Ownership Matters

Remote wipe should not be approached identically on every device.

Company-Owned Devices

Where a business owns and fully manages a device, it may have broader administrative control over the device.

Depending on the platform and configuration, administrators may be able to:

• Apply stricter security policies
• Restrict applications
• Lock the device
• Remove managed information
• Perform a full device wipe

Personally Owned Devices

BYOD environments require additional care.

An employee's personal phone may contain:

• Personal photographs
• Private messages
• Personal applications
• Personal documents
• Personal accounts

Where supported, organisations may use a management model that separates the managed work environment from the employee's personal information.

This may allow company-managed applications and information to be removed without erasing unrelated personal content.

The organisation should define its authority, employee responsibilities and privacy approach before a device is enrolled.

Why Device Enrolment Matters Before a Device Goes Missing

Remote security capabilities cannot be treated as something that is configured after a phone disappears.

Devices should be enrolled and appropriately configured before they are issued or used for business purposes.

An organisation should know:

• Which devices are managed
• Who or which department uses each device
• Which devices are company-owned
• Which devices are BYOD
• Which security policies apply
• Which remote actions are supported
• Who may authorise those actions

If a missing device was never enrolled correctly, the organisation may have significantly fewer options once it disappears.

Explore MDM device enrolment.

Remote Lock and Wipe Require Accurate Device Inventory

Imagine an IT administrator receives this message:

“The Oukitel tablet at the warehouse has been stolen.”

There are 25 similar tablets in the environment.

Which one should be locked?

Sending a remote command to the wrong device could interrupt another employee's work or, in the case of a wipe, create a much more serious problem.

A reliable MDM inventory should make it possible to identify devices using information such as:

• Device name
• Serial number or asset number
• Assigned user
• Branch or site
• Department
• Device group
• Ownership type
• Enrolment status
• Compliance status
• Last check-in

This is why consistent device naming, inventory management and ownership assignment are security controls as well as administrative practices.

Define Who Can Authorise Remote Lock and Wipe

Not every administrator or manager should necessarily have unrestricted authority to wipe devices.

A documented policy should define:

• Who may report a device as missing
• Who can request a remote lock
• Who can execute a remote lock
• Who can approve work-data removal
• Who can approve a full wipe
• What information must be reviewed first
• How BYOD devices are handled
• How administrative actions are recorded
• How failed commands are escalated

Remote lock may have a lower approval threshold than a full device wipe because its consequences are different.

A business should determine those thresholds based on its risk profile and operational requirements.

Define Who Can Authorise Remote Lock and Wipe

Not every administrator or manager should necessarily have unrestricted authority to wipe devices.

A documented policy should define:

• Who may report a device as missing
• Who can request a remote lock
• Who can execute a remote lock
• Who can approve work-data removal
• Who can approve a full wipe
• What information must be reviewed first
• How BYOD devices are handled
• How administrative actions are recorded
• How failed commands are escalated

Remote lock may have a lower approval threshold than a full device wipe because its consequences are different.

A business should determine those thresholds based on its risk profile and operational requirements.

Remote Lock and Wipe for South African Businesses

Remote device security can be particularly useful for South African organisations operating distributed mobile fleets.

Devices may be spread across:

• Branches
• Warehouses
• Distribution centres
• Retail stores
• Healthcare facilities
• Guard posts
• Vehicles
• Construction or customer sites
• Field-service teams
• Remote workers

Physical access to a device may therefore be impossible once it has been lost.

Connectivity also matters.

A phone used by a field worker may temporarily be outside reliable mobile coverage. A stolen device may be switched off. A tablet at a remote site may not reconnect immediately.

Organisations should therefore design their security processes around the possibility that a remote command cannot be executed immediately.

MDM can provide an important technical control, but it should operate alongside:

• User reporting procedures
• Identity and access controls
• Information-security policies
• Accurate asset records
• Incident-management processes
• Appropriate privacy safeguards

Where a lost or stolen device may involve exposure of personal information, the organisation should assess the incident within its wider information-governance and POPIA processes.

MDM itself does not automatically make an organisation POPIA compliant.

Examples of Remote Lock and Wipe in Different Industries

Logistics and Transport

A driver loses a company phone used for route communication and proof-of-delivery applications.

The business can identify the managed device, lock it remotely, assess its application access and consider removing company data if the phone cannot be recovered.

For broader fleet-management considerations, see our guide to MDM for logistics and warehousing.

Security Companies

A shared patrol phone cannot be accounted for during a shift handover.

IT can identify the relevant device, review its management status, lock it and determine whether company information should be removed.

The incident may also reveal a problem with the organisation's shared-device handover procedure.

Healthcare

A managed healthcare tablet goes missing between departments.

The organisation may need to secure the device promptly because it could provide access to patient, administrative or operational information.

MDM can support device-level security actions while the healthcare organisation follows its broader information-security and incident-management procedures.

Read our guide to Healthcare MDM in South Africa for healthcare-specific device governance.

Field Services

A technician's company tablet is stolen from a vehicle.

The business can lock the managed device, assess which work applications were accessible, revoke relevant account access where necessary and consider wiping the device according to its policy.

Common Remote Lock and Wipe Mistakes

1. Assuming MDM Can Recover Every Device

MDM can provide device information and remote security actions, but it should not automatically be presented as a physical tracking or guaranteed recovery service.

Capabilities vary according to the MDM solution, operating system, permissions and device configuration.

2. Assuming a Wipe Command Always Succeeds

A device may be offline, powered off, damaged or unable to communicate with the MDM service.

Administrators should verify command status rather than assuming that sending a command means it has executed.

3. Treating Remote Lock as the Complete Response

Locking the device reduces one type of risk.

The organisation may still need to review business application access, active sessions and the sensitivity of accessible information.

4. Wiping a Device Without Appropriate Approval

A wipe can remove information that the organisation still needs.

On some device configurations, it may also affect personal information.

Clear approval procedures are therefore essential.

5. Ignoring BYOD Privacy

A personally owned phone should not automatically be treated in exactly the same way as a fully managed company-owned device.

Device ownership, enrolment model, employee expectations and privacy requirements should be considered before deployment.

6. Relying on an Outdated Device Inventory

If IT cannot confidently identify the missing device, remote response becomes slower and riskier.

Accurate inventory and device naming should be maintained continuously.

7. Ignoring Offline Devices

Remote commands depend on the device being able to receive them.

Lost-device procedures should therefore include other safeguards such as account and session review.

8. Never Testing Remote Security Actions

A remote wipe policy that has never been tested is still partly theoretical.

Test representative devices and enrolment models under controlled conditions.

Remote Lock and Wipe Best-Practice Checklist

Before deploying company mobile devices, ask:

• Are business devices enrolled in MDM?
• Can IT identify each device accurately?
• Is ownership recorded?
• Are appropriate screen-lock and authentication policies applied?
• Do we know which remote actions each enrolment model supports?
• Is remote-lock authority documented?
• Is remote-wipe authority documented?
• Do we distinguish full wipe from selective work-data removal?
• Are BYOD privacy considerations documented?
• Have representative remote actions been tested?
• Can we determine whether a command succeeded?
• Are identity/access controls available if the device remains offline?
• Do users know how to report missing devices?
• Is there a process for documenting security incidents?

If several of these questions cannot be answered confidently, the business may need to review its mobile-device security processes before the next device goes missing.

Build Remote Lock and Wipe Into Your Mobile Device Strategy

Lost and stolen company devices are a foreseeable part of operating a mobile workforce.

The important issue is whether the organisation has the technology and governance processes needed to respond appropriately.

Remote lock can help reduce immediate access risk while a device may still be recoverable.

Work-data removal can provide a more targeted response where company-managed information needs to be removed separately from personal information.

Remote wipe can provide a stronger response where a managed device is stolen, unrecoverable or considered high risk.

None of these controls should operate in isolation.

A strong approach combines MDM with:

• Accurate device inventory
• Appropriate enrolment
• Security policies
• Identity and access management
• Clear administrative authority
• User awareness
• Tested procedures

MDM South Africa helps organisations implement practical mobile-device controls for company-owned, shared and field devices.

Explore MDM security management or contact MDM South Africa to discuss your device-security requirements.

Frequently Asked Questions

What is remote lock in MDM?

Remote lock is an administrator-initiated action that restricts access to an enrolled device without requiring physical access to it. It may be used when a company device is lost, stolen, misplaced or temporarily outside the organisation's control.

What is remote wipe in MDM?

Remote wipe is an administrative action that removes some or all information from a managed device. Depending on the device and enrolment configuration, this may involve removing managed company information, deleting a work profile or resetting the entire device.

Should I lock or wipe a lost company device?

Remote lock is generally more appropriate when a device may still be recovered. Work-data removal or remote wipe may be considered when the device is stolen, unrecoverable or presents a significant information-security risk.

The decision should follow the organisation's policy and consider device ownership, information sensitivity, enrolment model and likelihood of recovery.

Can MDM wipe a device that is offline?

A remote command may not execute until the device can communicate with the MDM service.

If the device remains offline, the organisation should also assess relevant account access and active sessions rather than relying only on the wipe command.

Can MDM track a stolen phone?

Some MDM platforms, devices and configurations may offer device-status or location-related capabilities, subject to technical, permission and privacy limitations.

MDM should not automatically be presented as a guaranteed device-tracking or recovery service.

Does remote wipe remove personal data?

It depends on device ownership, operating system, enrolment model and the action being performed.

Some configurations support removal of managed company information without deleting unrelated personal information. A full device wipe may remove personal information as well.

This should be understood and documented before devices are deployed.

Is remote wipe enough to protect company accounts?

No.

Remote wipe protects information on or managed through the device, but organisations may also need to revoke authenticated sessions, disable accounts, reset credentials or restrict access to cloud applications.

Does MDM support POPIA compliance?

MDM can support technical and organisational safeguards through controls such as device security, application management, remote lock, work-data removal, wipe capabilities and compliance monitoring.

MDM does not automatically make an organisation POPIA compliant.