Device Encryption - difference between "Not encrypted" and "Unmanaged"?

Hi LHerzog,

If device encryption shows as "Not encrypted," this means that the CDE is deployed on the device, but an encryption-on policy has not yet been applied, or the device has not yet been encrypted. This can also mean that the policy applied to the device states for it not to be encrypted.

If the device encryption state shows as "Unmanaged," this means the device is encrypted through other means, but Sophos is not managing the encryption policy on the device. An admin may have manually enabled BitLocker encryption. 

I'll be following up with our documentation team to ensure this gets documented. 

Hi LHerzog,

If device encryption shows as "Not encrypted," this means that the CDE is deployed on the device, but an encryption-on policy has not yet been applied, or the device has not yet been encrypted. This can also mean that the policy applied to the device states for it not to be encrypted.

If the device encryption state shows as "Unmanaged," this means the device is encrypted through other means, but Sophos is not managing the encryption policy on the device. An admin may have manually enabled BitLocker encryption. 

I'll be following up with our documentation team to ensure this gets documented. 

Hi Kushal, 

You said above that if it says unmanaged that it means the device is encrypted by something other than Sophos. What would it show if the CDE is deployed but the device is unencrypted by any means?  I believe that I am seeing on my clients that it also says unmanaged in that situation.

Thanks

Hi Bruce, 

Thanks for reaching out. I'd suggest referring to the following documentation link for encryption states. The reply I posted previously is not quite accurate.
- Sophos Central Documentation > Encryption status