What this guide covers
This guide walks through what Microsoft 365 can actually do to a laptop after it leaves your office, whether it walked out the door with a departing employee (I’ve seen everyone from ED, down not return a laptop), got left in a rideshare, or was reported stolen from a car. You will learn which control removes company data without a full wipe, and which one erases the device outright. You will see how a new laptop can pick up where the old one left off in minutes instead of a weekend of reinstalling software. You will also learn which two controls sound simple but actually require the Business Premium plan, so you are not caught off guard mid-crisis discovering you do not have a feature you assumed was included.
The real question isn’t whether a laptop goes missing
Every small business assumes a laptop will eventually leave the building without permission, whether through theft, loss, or an employee who never turns in company equipment after leaving. In practice, the real issue is not whether that happens. It is whether you already know which of four separate Microsoft 365 controls handles that situation, because most owners find out mid-crisis that a feature they assumed was included was not.
Remote wipe: Basic Mobility and Security
Basic Mobility and Security is the device wipe tool built into nearly every Microsoft 365 business plan, including Business Basic. You do not need Business Premium or a separate Intune license to use it. Once a device is enrolled, you can send one of two commands from the admin center: a factory reset that erases everything, or a selective wipe that removes only company data and leaves personal files alone.
The distinction matters more than it sounds like it should. A factory reset is closer to repossessing a company car outright. A selective wipe is closer to asking for the gas card back and letting the employee keep the car.
Use the factory reset for a lost or stolen company-owned laptop, where the whole device is compromised. Use the selective wipe for a personal phone or tablet enrolled under a bring-your-own-device policy, where you only have a claim to the company data, not the hardware. We can also remove access to company assets on personal mobile devices this way.
Setup does not take long. Turn on Basic Mobility and Security in the admin center, then enroll each device once. After that, the wipe commands live under Devices, then Mobile Device Management, ready whenever you need them. This is the control most small businesses already have and do not realize it.
Getting a replacement device working fast: OneDrive Known Folder Move
Wiping the old device solves half the problem. The other half is getting the new one productive without a weekend of manual file transfers. OneDrive Known Folder Move redirects the Desktop, Documents, and Pictures folders on a Windows machine into OneDrive automatically, so those files are already backed up before anything goes wrong.
This is available on any OneDrive for Business license, including Business Basic. Any employee can turn it on themselves from OneDrive settings (Settings, then Sync and Backup, then Manage backup) in a few clicks, with no admin involvement required.
The catch is that it only protects what was already turned on before the device left. If an employee never enabled it, there is nothing to hand off. For a small office without an IT department, the practical fix is turning it on for everyone once, during onboarding, rather than hoping people find the setting themselves. Enforcing it automatically across the whole team without asking each person is possible through Group Policy, if you run on-premises Active Directory, or through Intune, which requires Business Premium.
When the new device arrives, sign the employee into OneDrive with their work account and Known Folder Move restores their Desktop, Documents, and Pictures automatically. Depending on how much data is involved and your office’s internet connection, that sync can take anywhere from a few minutes to a few hours. Either way, it beats reinstalling everything by hand.
When you need more control: Autopilot Reset and Conditional Access
The controls above cover the two most common scenarios: wiping a device and moving a workspace to a new one. Two more controls exist for organizations that want to go further, but both require Microsoft 365 Business Premium. Neither works on Business Basic or Business Standard, so check your plan before you assume either is available to you.
Windows Autopilot Reset takes a device back to a clean, business-ready state without a full reimage, while keeping it enrolled in your organization’s identity and management systems. It is built for repurposing hardware, not for a security emergency: reset an outgoing employee’s laptop and it is ready for the next hire in the time it takes the process to run, with your standard apps and policies already in place.
Conditional Access blocks sign-in the moment a device or account looks wrong, before you have even opened the admin center to send a wipe command. Pair it with a policy that requires a compliant, managed device for access to company data, and a lost laptop stops being able to reach your files the instant you flag the account, not several minutes later when the wipe finally completes.
Both features come from the same underlying capability: Entra ID P1, bundled into Business Premium. If you are already paying for Premium for other reasons, Defender for Business is the usual driver, Autopilot Reset and Conditional Access are effectively free additions worth turning on. If you are on Basic or Standard specifically to avoid the higher price, upgrading only for these two features is a real cost decision, not an obvious yes.
The four controls at a glance
| Concept | What it means | Why it matters | What to do next |
|---|---|---|---|
| Basic Mobility and Security (remote wipe) | Built-in tool to erase or selectively wipe a device remotely | Works on every business plan, no premium tier needed | Turn it on in the admin center and enroll devices now, before you need it |
| OneDrive Known Folder Move | Automatically backs up Desktop, Documents, and Pictures to OneDrive | Lets a replacement device pick up the old one’s files without manual transfer | Turn it on for every employee during onboarding, not after a device is already gone |
| Windows Autopilot Reset | Returns a device to a business-ready state for reassignment | Saves the time of reimaging a laptop for the next hire | Requires Business Premium; use it when repurposing hardware, not during a security incident |
| Conditional Access | Blocks sign-in from a flagged account or non-compliant device instantly | Cuts off access before a manual wipe even starts | Requires Business Premium; pair with a compliant-device requirement for the strongest effect |
Our recommendation
If you take one thing from this guide, make sure Basic Mobility and Security is turned on and every company laptop is enrolled, today, before you need it. That single feature is included in your current plan and covers the most common emergency: a lost, stolen, or unreturned laptop. Turn on OneDrive Known Folder Move for every employee at the same time, so a replacement device is never a weekend project.
Autopilot Reset and Conditional Access are worth having, but only if you are already on Business Premium or have a specific reason to upgrade to it. Do not buy Premium for these two features alone unless your organization’s risk tolerance genuinely requires instant access revocation. For most small offices, the free tier of device control, wipe plus workspace backup, closes the gap that actually costs money when it goes wrong.
Frequently asked questions
Do I need Microsoft 365 Business Premium to remotely wipe a lost laptop?
No. Basic Mobility and Security, which includes both a full factory reset and a selective company-data wipe, is included in nearly every Microsoft 365 business plan, including Business Basic. Business Premium is only required for Autopilot Reset and Conditional Access.
What is the difference between a factory reset and removing company data?
A factory reset erases the entire device and everything on it, appropriate for a company-owned laptop that is lost or stolen. Removing company data only deletes the organization’s information and leaves personal files, photos, and apps in place, which is the right choice for a personal device or a straightforward employee departure.
How do I get a new employee’s laptop set up with their old files?
If OneDrive Known Folder Move was turned on for that employee before their old device was retired, their Desktop, Documents, and Pictures folders sync back automatically once they sign into OneDrive on the new machine. If it was never turned on, there is nothing to restore automatically, and files need to be recovered from wherever they were actually saved.
Can I stop someone from accessing company data the moment I suspect a laptop is compromised?
Yes, but only with Conditional Access, which requires Business Premium. It blocks sign-in immediately, before a manual wipe command even runs, which closes the gap between suspecting a problem and acting on it.
Is Windows Autopilot Reset the same as a factory reset?
No. Autopilot Reset clears user data and apps but keeps the device enrolled in your organization’s Intune and identity systems, so it comes back configured and ready for the next person. A factory reset removes the device from management entirely and requires setting it up again from scratch.