Skip to main content

156: WIP for Unenrolled

Implementation Effort: Medium — moving away from legacy unmanaged-device protections usually requires policy, app, and communications work.

User Impact: Medium — unmanaged Windows access patterns may change, especially where users relied on old protection behaviors.

Overview​

Windows Information Protection without enrollment is no longer a current strategy and should not be used for new deployments. For unmanaged or lightly managed Windows access scenarios, Zero Trust guidance should shift toward browser-based access, strong identity controls, Conditional Access, session restrictions, data classification, and modern Microsoft data-protection technologies instead of trying to preserve legacy WIP behavior.

Implementation Guidance​

  • Do not create new WIP-without-enrollment deployments. Treat any remaining use as a retirement project with a documented end state.
  • Identify which users, applications, and data flows still depend on the legacy scenario and determine whether the real requirement is unmanaged access, personal-device access, or a missing managed-device onboarding path.
  • For unmanaged access, prefer browser-based controls with Conditional Access, app-enforced restrictions, session controls, and data governance features rather than local Windows data-container assumptions.
  • Where the business requirement truly demands device trust, move the user population to supported Intune enrollment and compliant-device access instead of trying to preserve an unenrolled protection pattern.
  • Communicate changes clearly so users understand whether their access path is moving to web-only, managed desktop, virtual desktop, or another approved model.
  • Retire legacy policies in phases and confirm that regulated-data handling requirements remain satisfied after the migration.

Reference​