If someone hands me a Windows Phone 8.1 device, how can I determine if the phone has whole-device encryption enabled? Is there somewhere in the settings that indicates this?
The device is only encrypted when it is connected to an exchange or a company account that requires the phone to do so.
Device encryption is not enabled by default. Device encryption is automatically enabled in the following scenarios:
The user adds an Outlook account to the phone, and the Microsoft Exchange server that it connects to is configured to require device encryption.
The user connects the phone to a company apps account, and the enterprise device management server for the account pushes down a policy to the phone that requires device encryption.
On WP 8.1 phones one can check this via the Storage Sense app. If it shows storage encrypted there, the internal phone storage has been secured.