The Handset You Forgot Is Still Signed In: Retiring Old Devices Properly

Every small office has one. A drawer with an old iPhone, an Android handset, maybe a laptop that still has a charger taped to it. The screen is cracked, the battery is tired, and nobody quite remembers who used it last. It feels like e-waste. In access management terms, it is closer to a spare set of keys.

That device may still be signed in to work email, a shared drive, Teams or Slack, and an authenticator app that can approve sign-in prompts. It may still have a PIN that is someone's birthday. If it was handed on, sold, or left with a departing employee, the problem is bigger than a messy drawer.

This is not enterprise device management. It is the minimum routine for underdog teams in the UK who do not have a helpdesk, a security team, or a spare afternoon. Thirty minutes, one device at a time, and a written record.

Why the drawer is an access problem

Access management usually focuses on people: joiners, movers, leavers. Devices slip through. An old phone can hold cached email, browser sessions, cloud files and one very useful authenticator app. If it is still enrolled in mobile device management, it may also have a profile that lets someone reach company apps.

A device in a drawer is not automatically a breach. But it is an unmanaged endpoint holding company data. Under UK GDPR, that is personal data if it includes email, client files or staff records. If it goesmissing and someone can get in, you may need to assess whether it is a reportable incident to the ICO within 72 hours. Better to retire it properly than test that process.

Start by finding the things

Before the 30 minutes, do a quick sweep. Ask staff to bring old work phones and laptops to one place. Check your asset register, even if it is a spreadsheet with three columns and a hopeful note. Look in desks, cupboards, the server room and the bag cupboard. Label each device with the person it belonged to, if you know.

Do not power on an unknown device and connect it to the office Wi-Fi. If you need to check it, use airplane mode first. The aim is to identify what it can still reach, not to browse through someone's photos.

The 30-minute retirement routine

1. Confirm what the device can still access

From a separate admin computer, sign in to your main services: Microsoft 365 or Google Workspace, your file storage, your password manager admin console if you have one, and any line-of-business app. Look up the user and the device. Note which accounts are active. This is faster and safer than trusting the old handset.

2. Move the authenticator first

This is the step people skip, and it is the one that causes the most pain. If the old phone has an authenticator app, do not wipe it yet. Set up the new phone or a hardware key, test sign-in, then remove the old device from the account.

Some authenticator apps sync or allow an official export. Use the built-in transfer flow, not a screenshot of a QR code sent over chat. If you cannot transfer, reset MFA for that account from the admin console, then re-enrol the user. Keep recovery codes somewhere sensible, not in the drawer with the phone.

3. Revoke sessions and tokens

Changing a password is not enough if old sessions are still alive. In Microsoft 365, sign the user out of all sessions. In Google Workspace, reset sign-in cookies. In other apps, look for sign out everywhere or revoke all devices. This cuts off cached email and file access from the old handset.

If the device is lost or the user has left, change the password as well. If SMS is used for codes, ask the mobile provider to block the SIM and number. That closes the door on SMS interception.

4. Wipe through MDM, then remove the record

If the device is enrolled in mobile device management, use it to wipe the device first. Removing the MDM record before the wipe can leave you without a remote wipe option, which is the opposite of helpful. Once the wipe is confirmed, retire the device record.

If there is no MDM, do a factory reset on the phone. Remove the SIM and any memory card. Check that Apple Activation Lock or the Google account lock is cleared. For laptops, use full-disk encryption recovery and a proper wipe or reinstall. Factory reset is usually fine for modern encrypted phones, but if the device is old, faulty or high-risk, physical destruction of the drive is the safer call.

5. Back up only what policy allows

Company data should already live in the cloud. Do not copy work email or client files on to a personal drive to be helpful. If a departing employee has personal photos on a company phone, follow your policy and get their manager to agree what is copied and how. Handing over a USB stick with everything on it is not a retirement plan.

6. Log it and let it go

Update the asset register with the serial number, user, date retired, wipe method, who did it, and any disposal certificate reference. If you use a IT recycling firm, ask for a data destruction certificate and keep it with your records. If you sell or donate the device, make sure the wipe is documented first.

When the device never comes back

Sometimes the phone does not make it to the drawer. A leaver keeps it, a courier loses it, or it disappears from a hotel room. Treat that as an access incident, not an awkward admin task.

Suspend the account and revoke sessions straight away. Reset the password, remove the MFA method, and remote wipe through MDM if you can. Check recent sign-in logs and mailbox rules for anything odd. If the device was stolen, report it to the police and Action Fraud, and keep the crime reference. Tell your cyber insurer if your policy requires it, and assess whether personal data was likely compromised. If it was, document your reasoning; the ICO expects a 72-hour assessment, not a perfect speech.

If there is no MDM and no remote wipe, you cannot reach the device. Say so in the log, note what data it held, and decide whether the risk needs escalation. Do not wait for a polite email to bring the phone back.

Small habits that stop the drawer problem

Retire the old device on the same day the new one is enrolled. Keep one asset register that includes phones, laptops and tablets. Use basic MDM if you can; it turns a lost device from a mystery into a button. Prefer authenticator apps or passkeys over SMS codes. Do a ten-minute drawer sweep each quarter. And when a device leaves the building for good, make sure the wipe is recorded before anyone congratulates themselves.

The drawer is not storage. It is an access management problem with a charging cable. Give it half an hour and a line in the log, and it stops being a secret back door.