Is workstation-to-workstation communication restricted (e.g. RDP between user workstations)?
Workstations almost never need to reach each other. Where they can, one compromised laptop becomes a hundred.
What the carrier is actually asking
The carrier is asking whether devices on the user network can connect to each other directly, particularly over remote desktop and file sharing protocols. It is asking about host isolation rather than about network segmentation between zones.
Why it is underwritten
Lateral movement across workstations is how a single infection becomes a fleet-wide event. Blocking peer-to-peer traffic is one of the highest-value, lowest-cost controls available, and it is uncommon enough that answering yes distinguishes a submission.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Host isolation is enforced by endpoint firewall policy, which is delivered by device management and is not read by Insurance Posture, so this is attested.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Endpoint policy | Host firewall rules blocking inbound peer traffic | Inbound remote desktop and file sharing blocked between workstations. Attested |
| Endpoint policy | Whether the host firewall is enforced and cannot be disabled locally | Policy-managed and tamper-resistant rather than user-controllable |
| Network | Client isolation on wireless networks | Wireless clients isolated from each other |
| Network | Private VLAN or port isolation on wired segments | Wired isolation where the network supports it |
| Exceptions | Legitimate peer-to-peer needs | Enumerated and narrowly permitted, such as remote support tooling using a defined path |
Most organisations have never restricted this because nothing forced them to. Implementing it through host firewall policy is straightforward, breaks very little, and answers one of the few questions where a yes is genuinely uncommon.
What a defensible yes requires
- Inbound peer-to-peer protocols are blocked by managed host firewall policy.
- The policy cannot be disabled by a local administrator.
- Wireless client isolation is enabled.
- Support tooling uses a defined path rather than requiring general peer access.
- The restriction has been tested from one workstation to another.
How this answer goes wrong
The host firewall is enabled with default rules that permit file and print sharing across the local network, which is the most useful lateral movement path there is. The answer feels like yes because a firewall is running.
Frequently asked
Does this break anything?
Rarely. Some support tooling and screen sharing use peer connections and can be permitted explicitly. Most office workflows use servers and cloud services rather than peer connections.
What about home networks?
The host firewall policy travels with the device, which means it also protects the laptop on an untrusted home or hotel network.
Is this the same as segmentation?
Related and finer-grained. Segmentation separates zones; host isolation separates devices inside a zone.
How do we prove it?
Attempt a connection from one workstation to another and record the result. The policy export plus a test result is convincing evidence.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture