A loan laptop or spare mobile device can keep a member of staff working when their usual equipment fails. Yet an informal handover can create uncertainty about who is using the device, what information remains on it and when it must be returned. A small IT support team needs a practical loan-device process connecting the physical asset to an authorised person, a legitimate purpose, a controlled configuration and a clear return event. The objective is business continuity without losing asset custody or leaving previous users' accounts and files on equipment that will be handed to somebody else.
A loaner is not necessarily a new device. It may have been repaired, returned from another employee or stored as an emergency spare. Its current condition and data protection matter as much as the name in the register. A technician should not assume that a device marked Available is ready to issue: it could lack security updates, contain an old user profile or have an unresolved fault. The correct handover begins with verifying the item and the person authorised to receive it.
Confirm the request and authorisation
Record who needs the equipment, why, which team or client owns the request and who may approve its use. A loaner for a newly hired remote worker may have different requirements from a temporary replacement during repair or an emergency spare for a critical business role. Identify whether the device may leave the office or be used for particular sensitive applications. A support technician should not grant access to confidential client data simply because a manager says any spare computer will do. Check the current organisation's asset and identity policies.
Use a ticket or controlled handover reference connecting the request to the receiving person and authorised business owner. If the device belongs to a client rather than the MSP, confirm the client's permission to issue it. Record a planned review or return condition without promising that a complex repair will finish on an arbitrary date. The loaner may remain necessary until the original equipment is tested and accepted. A clear owner can decide whether to extend the assignment or obtain a permanent replacement.
Identify and inspect the physical item
Use the approved asset tag, serial or reliable identifier, not only a model description. Check visible condition, screen, keyboard, charging connector, power adaptor and any other accessories required by the recipient. Note material damage and missing components before issuing the equipment. If a battery appears swollen or a power component is unsafe, follow the competent safety route rather than energising the device to complete an administrative checklist.
Distinguish the actual laptop from its peripherals. Chargers, docking stations, headsets and adapters may be shared across a pool but should still have custody records where required. Confirm compatibility instead of giving the first available connector. Record the location from which the loaner is being collected and the receiving person. A ticket may say 'issued' while the device remains in a cabinet; use a meaningful physical handover status and evidence.
Check management and security readiness
A spare device should meet the organisation's current endpoint security baseline before users sign into it. Depending on the environment, this may include supported operating-system updates, management enrollment, disk encryption, endpoint protection, screen locking and the correct compliance policies. Review whether it is associated with a previous user's account or an obsolete tenant. A clean desktop appearance does not prove previous credentials and data have been removed. Follow the approved redeployment or sanitisation process before assigning the asset.
Do not rely on a universal local administrator password or bypass multifactor authentication to speed up a handover. Use named accounts and supported device enrollment where available. A remote user may need an approved first-login method and access to IT support before the corporate network is available. Identify which controls can be verified before issuance and which require user sign-in. Record actual evidence rather than a green checkbox that another technician cannot interpret.
Prepare applications for the legitimate work
Ask the business owner which functions must remain available while the employee uses the loaner. A standard laptop can be sufficient for communication and office work but unsuitable for a specialist production application, high-performance design task or restricted security function. Confirm licence entitlement and any required VPN, certificate, peripheral or supplier access. Do not install unapproved software or copy another person's application profile merely to make the loaner appear familiar.
Use a representative test task to verify readiness. Can the recipient sign in using the approved identity, reach the required service and open the necessary file or application? Test without exposing sensitive customer data. If a specialist application cannot be made ready, record the limitation and let the manager decide the authorised temporary work plan. Device delivery is not equivalent to business readiness, particularly when a remote employee has little alternative support.
Record the handover in understandable terms
The receiving person should know what they are responsible for, which equipment and accessories were supplied, any stated limitations, how to report damage or loss and the expected return route. A long legal document is not required for every ordinary loan, but the organisation should use its authorised policy for custody and acceptable use. Avoid language claiming that the user automatically accepts all liability regardless of applicable employment or consumer rights. Keep the actual condition and identity evidence separate from any contractual terms.
Give the recipient the current support contact and a way to report failure if the loaner cannot authenticate. Explain whether the device is suitable for travel, home working or shared office use. If data must be stored only in approved cloud or network locations, state that clearly. Do not encourage use of personal accounts or external storage to bypass access problems. Record acknowledgement of the physical handover without treating a signature as proof of correct technical configuration.
Manage extensions and repairs without losing ownership
When the original device is awaiting parts or the employee's role changes, the loan period may need review. Keep the current assigned user, business justification, original ticket link and responsible manager visible. A loaner that becomes a permanent replacement should go through an approved asset transfer rather than simply remaining out indefinitely. Update the asset and licence records together where appropriate. If the employee changes office, record the actual location rather than assuming the initial delivery address remains correct.
A loaner may develop its own issue. Open a separate technical assessment linked to the custody record so staff know whether it is still safe to use and whether another replacement is necessary. Do not overwrite the original device repair ticket with unrelated faults. If a user reports loss or theft, follow the security process promptly and record confirmed observations rather than speculating about misconduct.
Coordinate return before assigning the next user
Plan the return when the original or permanent device is ready, and ensure the employee has completed any approved transfer of business data. Some work may have been stored locally on the loaner, and it should not be destroyed before the authorised owner checks whether it must be retained. Conversely, personal or confidential data must not remain when another person receives the device. The correct method is a managed data transfer and redeployment procedure, not allowing the next user to inherit the previous profile.
At collection, reconcile the asset identifier and accessories, check condition and note any new damage. Distinguish 'return requested', 'courier booked', 'received at IT' and 'cleared for reuse'. A parcel tracking page does not prove that the correct laptop was inside. If a component is missing, investigate against the documented outgoing inventory and recent handovers rather than silently changing the historical record. Keep accountability clear when the item moves between offices or an external repair supplier.
Sanitise and validate for the next assignment
After custody is restored, apply the approved wipe, reimage or reset procedure appropriate to the organisation's device management and data requirements. The UK National Cyber Security Centre's device guidance supports controlled protection of managed endpoints, while Microsoft Intune provides vendor-specific device lifecycle actions such as wipe, retire and reset. Those actions differ in what data and management state they affect; choose based on actual ownership and policy rather than assuming each button is interchangeable.
Verify the device is healthy and securely managed before marking it Available again. Confirm the correct tenant, encryption, updates and endpoint protections. Check for an unresolved hardware problem and perform relevant functional testing. Record what was completed, by whom and when. A device being physically on a shelf does not make it ready for the next employee. If a sanitisation operation has not executed because the device is offline, retain the exception and do not issue it as clean.
Review the pool and recurring demand
Analyse how often loaners are issued, why equipment remains out beyond planned review dates and whether staff regularly need specialist applications not installed on the spare pool. Poor stock planning can leave a user without suitable equipment despite several idle devices. Conversely, excessive unused loaners may incur unnecessary management and replacement costs. Base decisions on actual assignments, device condition and approved demand rather than invented utilisation targets.
Connect loaner records to device repairs, new-starter provisioning, staff transfers and offboarding. A leaver process should identify a loan laptop as company property even if it was never entered into the person's permanent asset record. A replacement request should distinguish temporary continuity from permanent procurement. This prevents repeated ownership questions at the exact moment when urgent work needs a dependable device.
Close with an auditable custody lifecycle
A successful handover leaves the right employee with the right managed equipment, clear limitations and a usable support route. A successful return establishes that IT received the correct item, recovered legitimate business data, applied appropriate security procedures and can explain its current status. Keep unresolved risks visible. The asset register is useful when it reflects these real events, not when every record merely says Issued or Returned. That practical discipline lets a small support team provide continuity without losing control of the loan fleet.
Sources: UK NCSC, Device Security Guidance for managed endpoint protections and lifecycle principles; Microsoft Learn, Wipe and retire devices with Microsoft Intune for vendor-specific remote device actions and limitations. Neither establishes the legal custody or acceptable-use agreement for a particular employer.
Distinguish an available spare from a managed, ready-to-issue device
A loan laptop may be physically in a cupboard while still containing a previous user's profile, requiring updates or carrying an unresolved hardware fault. Record the approved recipient, intended use, asset serial, any accessories and the reason for the loan. Then confirm device management, the user's permissions, encryption and representative work tasks. A green inventory flag cannot prove that the employee can access an essential application or that a managed wipe has completed.
Record an actual physical handover and a separate return condition
At issue, check the device tag, power supply, screen, physical condition and approved receiving person. Give the user the genuine support channel and instructions for reporting loss or damage. If the employee extends the loan, update the authorised custodian and review date rather than erasing the initial agreement. At return, verify the actual asset and accessories, reconcile legitimate work data and decide the appropriate sanitisation route. Do not mark the laptop ready for the next user merely because a courier returned the package.
Validate remote actions before reissue
Remote reset and retirement features are platform-specific and may require network contact, device eligibility and particular permissions. A queued action is not the same as a device reporting successful execution. For a previously assigned or lost device, follow authorised endpoint-management procedures and confirm the result, including any retained management state. If wipe or sanitisation cannot be verified, keep the asset unavailable for reassignment and retain the exception owner. Maintain separate records for original equipment under repair and the temporary loaner.
Loan laptop issue versus return and safe reallocation
The physical asset moves in opposite directions at these two stages, but both require evidence that the right device and data are under the right control.
| Control | Before issuing to employee | After return to IT |
|---|---|---|
| Identity and physical custody | Approve the named recipient, use, stable asset identifier and location. | Verify the same physical asset, return time, condition and received accessories. |
| Managed security state | Confirm required identity, encryption, updates, policy and supported access. | Perform and verify appropriate removal of previous user data and permissions. |
| Business work | Test an essential authorised app and working support channel. | Retain or transfer legitimate user data only as permitted by business policy. |
| Hardware condition | Document existing damage, battery and charger suitability. | Inspect new faults and decide whether repair, disposal or reuse is appropriate. |
| Completion evidence | Actual user receipt and limitations acknowledged; review or return route defined. | Physical return and technical readiness separately verified before marking Available. |
Practical decision: A loan record closes only when actual custody and device-state checks are complete. If an employee returns a laptop while it still contains confidential work, assign an authorised data-handling action before reissue. If a remote wipe is pending, preserve the pending status rather than claiming the device is clean. Document unexpected damage and missing accessories using the evidence recorded at issue.
Source A — managed device safeguards: UK National Cyber Security Centre, Device Security Guidance offers general advice for protecting managed endpoints. Source B — a vendor's remote reset: Microsoft Learn, Wipe devices with Microsoft Intune explains remote wipe behaviour, prerequisites and supported platforms; it cannot prove that a given wipe request executed on a client's device. These sources support security practices and platform actions respectively; the table is original operational synthesis, not a legal custody contract.
Frequently asked questions
What should IT record before giving somebody a loan laptop?
Capture approved user and business purpose, stable asset identifier, physical condition, accessories, security readiness, expected return route and an accountable support contact.
Can a loaner be issued straight after the previous person returns it?
Only after the authorised data and account handling, device-management checks and relevant functional inspection. Physical return alone does not prove the device is safe for another user.
What if an employee needs the loaner longer than expected?
Record the approved extension, continued business need, current custody and outstanding repair or replacement dependency rather than silently changing the original timeline.
Does an Intune wipe always prove all information has been removed?
No. The actual action, device state, execution confirmation and organisational policy determine the result. Review Microsoft-specific wipe and retire behaviour and verify completion.
When is the loan-device record fully closed?
When IT has confirmed the correct device and accessories, addressed legitimate business data, verified the return condition and updated its true security and availability state.