Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Quietly Mandates Enterprise Network Segmentation for All
Transcript
- Lucas: So we've spent a lot of episodes on Windows 11 quietly mandating things like BitLocker, credential guard, USB controls. Today I want to talk about a mandate that's a bit more architectural: network segmentation. Microsoft is now requiring that enterprise Windows 11 devices enforce network segmentation via Group Policy and the Windows Defender Firewall. Luna: When you say 'require' — is this a hard block like TPM 2.0, or more of a compliance nag? Lucas: It's closer to the compliance nag model, but with teeth. If an enterprise device doesn't have a network segmentation policy applied — meaning it hasn't defined separate profiles for corporate, guest, and IoT traffic — the security center will flag it as non-compliant. And for organizations using Intune or Configuration Manager, that can block access to corporate resources. Luna: Okay, so it's really about enforcing a zero-trust network architecture at the endpoint level. But what's the specific technical mechanism here? Lucas: The key new object is something Microsoft calls the 'NetworkSegment' policy. It's a Group Policy extension that lets admins define up to five network profiles — corporate, guest, IoT, DMZ, and a catch-all 'untrusted.' Each profile has its own firewall rules and routing preferences. The real innovation is the integration with Hyper-V virtual switch isolation. Luna: Ah, so they're using the same tech that separates VMs from each other. That makes sense — containerize the traffic at the OS level. Lucas: Exactly. So if a user plugs in a rogue IoT device — say a smart thermostat — Windows 11 can detect its network behavior, classify it as IoT, and automatically shunt it to the IoT profile. That profile has no route to the corporate LAN. The device can phone home to its cloud, but it can't touch the file server. Luna: That's powerful, but I'm wondering about the admin burden. For a mid-sized IT team with maybe two or three people, defining five network profiles and testing firewall rules sounds like a lot of work. Lucas: That's the tension. Microsoft's argument is that 62 percent of breaches in 2024 started on the local area network — that's from a CISO survey they commissioned. And a huge chunk of those were lateral movement from an unsegmented IoT device or a guest Wi-Fi connection. They see segmentation as the single most effective control after patching. Luna: But for a small team, that's a big ask. Do they provide templates or starter policies? Lucas: They do. In the Windows 11 2025 Update, there's a new Security Baseline that includes a starter segmentation policy. It creates three profiles out of the box — corporate, guest, and IoT — with sensible defaults. Corporate gets full access, guest gets internet only, IoT gets internet plus a management subnet. The admin can then tweak from there. Luna: So the mandate is really about having segmentation policy applied, not a specific one. That's more reasonable. Lucas: Right. If you apply the starter policy, you're compliant. The heavy lifting is only if your organization has unique requirements. But I think the bigger shift here is cultural: Microsoft is essentially saying that flat networks are no longer acceptable for any Windows 11 enterprise device, even in small deployments. Luna: And that ties into everything we've been seeing — the push toward zero trust, the deprecation of legacy protocols, the hardening of the network stack. It's consistent. Lucas: I want to get into a real-world example. There's a case study Microsoft published — a mid-sized manufacturer in Ohio, about 500 employees. They had a flat network, one SSID for everything, and a bunch of IoT sensors on the factory floor. They implemented the starter policy in about two weeks. IT lead said the biggest surprise was how easy it was — the tricky part was auditing all the devices to make sure they were classified correctly. Luna: Yeah, classification is the hard part. How does Windows 11 actually decide what's a 'corporate' device versus 'IoT'? Is it MAC address based, or something smarter? Lucas: It's a combination. The initial classification is based on the network adapter's driver metadata and the device's certificate. If a device has a domain-joined certificate, it's corporate. If it has no certificate but connects to a specific SSID that's tagged as IoT, it goes to that profile. There's also a learning mode — you can let it run for a week and it will suggest classifications based on traffic patterns. Luna: That learning mode is smart. But it also means the first week could be noisy — devices hopping profiles as the system learns. Lucas: That's exactly what happened with the Ohio manufacturer. Some barcode scanners kept flipping between corporate and IoT because they were talking to both the ERP system and the cloud. They had to pin those devices manually. But after that, it stabilized. Luna: If today's tech conversation gave you something usable — maybe a new way to think about network security, or a specific policy to check — that's exactly why we do this show. We deliberately don't run ads on these episodes. If you want to support that choice, the link is buy me a coffee dot com slash fexingo. Lucas: Yeah, it's a small gesture that keeps the whole thing ad-free. Appreciate anyone who chips in. Luna: So back to the mandate — one thing I find interesting is that Microsoft is essentially forcing a conversation that many IT teams have been avoiding. Network segmentation is one of those things everyone knows they should do, but it's perpetually on the backlog. Lucas: Absolutely. And I think that's why they made it a compliance check rather than a hard block. They want to create organizational pressure. When the security dashboard shows a red 'Non-compliant — Network Segmentation' badge, somebody has to explain that to the CISO. Luna: Does this apply to Windows 10 devices still in the enterprise, or is it Windows 11 only? Lucas: Windows 11 only. The NetworkSegment policy object requires the new Windows Filtering Platform engine that shipped with the 2025 Update. Windows 10 is stuck on the old firewall architecture. Microsoft has been pretty clear that if you want the modern security stack, you need to move to Windows 11. Luna: That's another nudge toward Windows 11 migration. But I wonder about compatibility with third-party firewalls. If an enterprise uses Cisco or Palo Alto on the endpoint, does the Microsoft segmentation policy conflict? Lucas: It can. Microsoft's documentation says that if you use a third-party firewall, you should disable the Windows Defender Firewall entirely, and then the segmentation policy won't apply. But that means you're relying entirely on the third-party product to enforce segmentation. Some of those products have their own profile features, but they're not always mapped to the Windows 11 classification engine. Luna: So there's a risk of fragmentation. The classification might work in Windows, but the third-party firewall might not honor it. Lucas: Exactly. And that's a real pain point. Microsoft is essentially saying 'use our stack or manage the complexity yourself.' For large enterprises that already have a security vendor relationship, that's a tough sell. Luna: What about cloud-only environments where devices are managed by Intune and there's no on-premises Group Policy? Lucas: Intune supports the NetworkSegment policy through the Settings Catalog. It's actually easier in some ways because you can assign profiles to Azure AD groups. You can have a 'factory-floor' group that gets the IoT profile, and an 'executive' group that gets corporate. The policy syncs down just like any other configuration profile. Luna: That's clean. I think the cloud story is actually stronger than the on-prem one here, because you can tie it to identity rather than just network location. Lucas: That's a good point. The on-premise model still relies on things like subnet matching and DNS suffixes. In Intune, it's purely user and device based. So a user who logs into a kiosk in the lobby gets the guest profile, but when they log into their corporate laptop, they get full access. Luna: Let's talk about the enforcement date. We're recording this in July 2026. When does this mandate actually kick in for existing devices? Lucas: Microsoft announced it as part of the 2025 Update's security baseline, so technically it's effective now. But they've given a grace period until October 2026 for existing deployments to get compliant. New deployments after January 2026 are expected to have it from day one. Luna: So there's a three-month window for IT teams to get their act together. That's not a lot of time if you haven't started. Lucas: No, it's not. And I think that's deliberate — they want to create urgency. But the starter policy is genuinely simple. If you're on Windows 11 and you've updated to the 2025 Update, you can apply it via a single GPO or Intune policy. The real work is auditing your device inventory to make sure classification is right. Luna: And that audit is where most teams will stumble. Because they might have devices they didn't even know were on the network — old printers, forgotten sensors, employee personal phones. Lucas: Yeah. The Ohio manufacturer found 15 devices they had no record of — mostly old Wi-Fi scales and a weather station that someone had plugged in years ago. Those all got shunted to the IoT profile automatically, which actually solved a security gap they didn't know they had. Luna: So there's a silver lining. The mandate forces a device inventory, which is good practice anyway. Lucas: Right. And I think that's the theme of these quiet mandates — they're nudges toward better hygiene. BitLocker, credential guard, now network segmentation. Each one raises the baseline. It's frustrating for IT teams that have to scramble, but the end result is a more secure environment. Luna: We'll see how the October deadline plays out. I suspect a lot of organizations will be in a panic in September. Lucas: Probably. And we'll do a follow-up episode then to see how it's going. For now, the message is: if you're on Windows 11, check your security center. If you see a red badge for network segmentation, you know what to do.