Data protection disabled
A check of server-side data protection information. The check policy does not enable encryption by itself.
Condition and parameters
In the current build, the additional parameters below are visible in the form, but these values are not sent to the server on save. Their purposes are described based on the form hints. Do not rely on the selected values being applied until the save fix is confirmed and verified on a device.
| Parameter | Purpose and values | Verification and dependencies |
|---|---|---|
| Require encryption | Violation if system encryption is turned off. | Toggle. Not sent as a setting when saving the current form. |
| Require PIN/password | Violation if the lock screen is not protected. | Toggle. Not sent as a setting when saving the current form. |
| Password complexity | Minimum level for the device password. | Options: Simple, Medium, Strong. Not sent as a setting when saving the current form. |
| Time to remediate | How much time to allow for remediation before a violation. | Duration. Not sent as a setting when saving the current form. |
Response and assignment
Select a response and assign the policy. Use the administrator notification first. Locking requires a separate check of the command on a test device.
How to verify
Check the assignment, the freshness of the server data, the result of the check run, and the entry in “Violations”. Verify the response in the history, and the lock on the device. Do not treat the absence of a violation with unknown or stale telemetry as confirmation of security.