Coming Soon: GET:IT Endpoint Management 1-Day Conference on September 28th at 9:30 AM ET Coming Soon: GET:IT Endpoint Management 1-Day Conference on September 28th at 9:30 AM ET

Introduction to Windows Information Protection

In this Ask the Admin, I’ll explain what Windows Information Protection (WIP) is and how it works to protect sensitive business data.

As part of a defense-in-depth security strategy, Data Loss Prevention (DLP) products control how information that employees have legitimate access to is used. Microsoft says 87 percent of senior managers have admitted to sending corporate data to personal cloud storage and email, and that 58 percent of employees have accidentally sent information to the wrong person. Company documents might be sent to the wrong people when they’re copied in emails unnecessarily, and information might also leak online when posted either intentionally or by mistake.


Sponsored Content

Say Goodbye to Traditional PC Lifecycle Management

Traditional IT tools, including Microsoft SCCM, Ghost Solution Suite, and KACE, often require considerable custom configurations by T3 technicians (an expensive and often elusive IT resource) to enable management of a hybrid onsite + remote workforce. In many cases, even with the best resources, organizations are finding that these on-premise tools simply cannot support remote endpoints consistently and reliably due to infrastructure limitations.


Designed as an alternative to third-party DLP solutions, such as Samsung Knox and Symantec Data Loss Prevention, Windows 10 Anniversary Update includes support for WIP, previously known as Enterprise Data Protection (EDP). Unlike third-party DLP products, WIP is built into Windows so that Microsoft can offer a seamless user experience. Many other products require the use of special applications or to switch modes when working with corporate data, adding a significant layer of inconvenience for both users and IT.

Windows Information Protection (Image Credit: Microsoft)
Windows Information Protection (Image Credit: Microsoft)

WIP is managed using Mobile Device Management (MDM) policy, as it is also supported in Windows 10 Mobile. Any app can encrypt corporate data when WIP is configured on a device, but only enlightened apps (i.e., those that are WIP-enabled through a set of APIs provided by Microsoft) permit users to save data as personal if WIP policy allows it. So far, there’s only a small set of apps that have been enlightened for WIP, including Internet Explorer 11, Microsoft Edge, Office 2016 desktop and mobile, but the short list shouldn’t prevent you from deploying WIP.

WIP uses the Encrypted File System (EFS) to protect data, and encryption is retained across devices. It’s worth noting that as a Windows technology, WIP is compatible only with devices running Windows 10 or Windows 10 Mobile, which might be a significant disadvantage for organizations using other mobile platforms.

In conjunction with Azure Rights Management (Azure RMS), which is soon to become Azure Information Protection, the protection provided by WIP can be extended into the Office 365 cloud, and Azure RMS allows data to be securely shared with external business partners. Additionally, while the ability to wipe remote devices is not new, because of the separation of business and personal data that WIP provides, IT can wipe business data from employee-owned devices with confidence that they won’t touch personal data.

For more information on how to deploy Windows Information Protection, stay tuned to the Petri IT Knowledgebase.

Related Topics:


Don't have a login but want to join the conversation? Sign up for a Petri Account

Comments (0)

Leave a Reply

IT consultant, Contributing Editor @PetriFeed, and trainer @Pluralsight. All about Microsoft, Office 365, Azure, and Windows Server.
Live Webinar: Active Directory Security: What Needs Immediate Priority!Live on Tuesday, October 12th at 1 PM ET

Attacks on Active Directory are at an all-time high. Companies that are not taking heed are being punished, both monetarily and with loss of production.

In this webinar, you will learn:

  • How to prioritize vulnerability management
  • What attackers are leveraging to breach organizations
  • Where Active Directory security needs immediate attention
  • Overall strategy to secure your environment and keep it secured

Sponsored by: