Description: Allows the cellular data channel on the device. Device reboot is not required to enforce the policy.

Why It's Important: This policy is like disabling a mobile hotspot to ensure all traffic flows through a secure, monitored network. By blocking cellular data, SHIELD helps enforce network usage policies, reduce the risk of data leakage over untrusted connections, and ensure that all device traffic is routed through corporate-approved channels. It’s especially important in environments where data security, cost control, or compliance with network monitoring requirements is critical.

Learn More

Description: Allows or disallows cellular data roaming on the device. Device reboot is not required to enforce the policy. Most restricted value is 0.

Why It's Important: Disabling cellular data roaming helps prevent devices from connecting to networks outside the organization’s control, which can pose security and cost risks. Roaming networks may lack proper encryption or monitoring, making sensitive data vulnerable to interception. By enforcing this policy, SHIELD ensures that devices only communicate over trusted, managed connections—like keeping conversations within secure meeting rooms instead of shouting across a crowded street. It also helps avoid unexpected charges and ensures compliance with data handling policies, especially in regulated environments.

Learn More

Description: Allows IT Admins the ability to disable the Connected Devices Platform (CDP) component. CDP enables discovery and connection to other devices (either proximally with BT/LAN or through the cloud) to support remote app launching, remote messaging, remote app sessions, and other cross-device experiences. Note: This policy requires reboot to take effect.

Why It's Important: Blocking connected devices prevents systems from automatically discovering and interacting with other devices, which can introduce security risks. These cross-device features—while convenient—can create unintended pathways for data leakage, unauthorized access, or lateral movement in an attack. SHIELD enforces this policy to ensure that endpoints remain isolated from uncontrolled device interactions, reducing the attack surface and maintaining strict boundaries around enterprise assets. It’s like disabling auto-pairing on a secure walkie-talkie—only trusted channels are allowed, and nothing connects unless explicitly permitted.

Learn More

Description: This policy allows IT admins to turn off the ability to Link a Phone with a PC to continue tasks, such as reading, email, and other tasks that require linking between Phone and PC. If you enable this policy setting, the Windows device will be able to enroll in Phone-PC linking functionality and participate in 'Continue on PC experiences'. If you disable this policy setting, the Windows device is not allowed to be linked to phones, will remove itself from the device list of any linked Phones, and cannot participate in 'Continue on PC experiences'. If you do not configure this policy setting, the default behavior depends on the Windows edition. Note: Changes to this policy take effect on reboot.

Why It's Important: Linking phones to PCs introduces a potential bridge for data to move between personal and corporate environments, which can compromise security and compliance. Features like “Continue on PC” may unintentionally expose sensitive information or create unmonitored access points. SHIELD blocks this functionality to ensure that enterprise devices operate within clearly defined boundaries, keeping work data separate and secure. It’s like preventing a secure office computer from syncing with a personal device—convenient, but risky. This policy helps maintain data integrity, reduce shadow IT risks, and enforce a clean separation between personal and professional digital spaces.

Learn More

Description: Specifies what type of underlying connections VPN is allowed to use. Most restricted value is 0.

Why It's Important: Blocking VPN over cellular ensures that encrypted traffic only flows through trusted, monitored network connections. Cellular networks—especially public or roaming ones—can be unpredictable, harder to audit, and more vulnerable to interception or misconfiguration. By enforcing this restriction, SHIELD helps prevent sensitive data from traveling over potentially insecure mobile channels. It’s like choosing to send confidential documents through a secure courier instead of a public drop box—more control, less risk. This policy supports consistent network security posture and helps organizations maintain compliance with data protection standards.

Learn More

Description: Prevents the device from connecting to VPN when the device roams over cellular networks. Most restricted value is 0.

Why It's Important: Roaming cellular networks are often unpredictable and may route traffic through foreign or untrusted infrastructure, increasing the risk of data exposure—even when using a VPN. Blocking VPN usage during cellular roaming ensures that encrypted communications don’t travel over potentially insecure or costly connections. SHIELD enforces this policy to keep sensitive enterprise traffic confined to trusted networks, reducing the risk of interception and maintaining compliance with data protection standards. It’s like refusing to discuss confidential business over a public payphone while traveling—secure communication should only happen through verified, controlled channels.

Learn More

Description: Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftconnecttest.com/connecttest.txt to determine if the device can communicate with the Internet. This policy disables the NCSI active probe, preventing network connectivity to www. msftconnecttest. com. Value type is integer.

Why It's Important: Disabling active network connectivity tests prevents devices from reaching out to external Microsoft endpoints just to verify internet access. While useful for consumer devices, these probes can be unnecessary or even problematic in tightly controlled enterprise environments. SHIELD blocks this behavior to reduce outbound traffic, avoid false positives in network monitoring tools, and prevent unnecessary exposure to external services. It’s like disabling a car’s automatic GPS ping when driving in a secure zone—less noise, more control, and fewer chances of leaking location or status data.

Learn More