I am writing a .NET Web API that will be used in an enterprise environment where users authentication themselves using their active directory credentials, so I am using "Windows Authentication" in IIS as authentication scheme for my API, but I am wondering does "Windows Authentication" mean by default that the connection will be secured and the data going through the wire will be encrypted? or it is just used for authentication and the encryption will be my own responsibility? and if it is, how do I secure my data while sending/receiving it if I am using "Windows Authentication"?
Windows Authentication only refers to the authentication part and does not mean that the data you transfer are protected. You still need to use HTTPS for data protection.