Disk encryption¶
Encryption protects data on lost and stolen devices. The hard part isn't turning it on, it's making sure every key is escrowed, retrievable by the right people, and rotated after use.
Configure both under Endpoint security > Disk encryption. Monitor them in Devices > Monitor > Encryption report.
BitLocker (Windows)¶
Silent encryption¶
Most organizations want BitLocker to turn on with no user interaction. That's silent encryption, and it has prerequisites:
- A TPM (1.2 or 2.0), unlocked and ready. UEFI firmware is required for TPM 2.0.
- Windows Recovery Environment (WinRE) enabled.
- Standard partitioning: an NTFS OS drive and a system partition of at least 350 MB.
- The device is Entra joined or hybrid joined.
- No startup PIN. Silent encryption only works with TPM-only protection.
Recommended BitLocker policy¶
| Setting | Value | Why |
|---|---|---|
| Require Device Encryption | Enabled | Turns BitLocker on |
| Allow Warning For Other Disk Encryption | Disabled | Required for silent encryption |
| Allow Standard User Encryption | Enabled | Lets encryption run when the signed-in user isn't an administrator |
| Configure Recovery Password Rotation | Refresh on for Entra joined devices (or for Entra joined and hybrid joined) | A recovery password is rotated after it's used |
| Choose drive encryption method | XTS-AES 128 (or 256 if your standards require it) | Set this before devices encrypt. Changing it later means decrypting and re-encrypting. |
| Save BitLocker recovery information to Entra ID | Enabled | Escrows the key |
| Store recovery information in Entra ID before enabling BitLocker | Required | Encryption doesn't start until the key is safely escrowed |
| Configure TPM startup | Allow or require TPM; startup PIN and startup key not allowed | Required for silent encryption |
Notes:
- Put BitLocker in one policy. BitLocker settings also exist in security baselines and the settings catalog, and conflicts stop encryption.
- Entra ID stores at most 200 recovery keys per device. Devices that hit the limit fail silent encryption because the key can't be backed up.
- For extra protection of user files on Windows 11, look at Personal Data Encryption, which you can also configure in the disk encryption node.
Who can read recovery keys¶
Reading a BitLocker recovery key is an Entra ID permission, not an Intune one: microsoft.directory/bitlockerKeys/key/read. It's included in the Cloud Device Administrator, Helpdesk Administrator and Global Administrator roles. For a tighter design, create a custom Entra role with just this permission, optionally scoped to an administrative unit.
To retrieve a key: Devices > All devices > select the device > Recovery keys > Show Recovery Key. Every view is audited.
Users can also see the keys for their own devices at myaccount.microsoft.com, unless you turn on the Entra device setting Restrict users from recovering the BitLocker key(s) for their owned devices.
Rotating keys¶
After a key has been read or used, rotate it with the BitLocker key rotation device action. Rotation requires the rotation, Entra escrow and store before enabling settings above.
Back up keys before deleting Entra joined devices
Deleting or retiring the Intune record of an Entra joined device removes the BitLocker key protectors and leaves BitLocker suspended. Deleting the device from Entra ID deletes its escrowed recovery keys. If there's any chance you'll need the data, record the recovery key first. See Device actions and lifecycle.
Troubleshooting BitLocker¶
| Symptom | Check |
|---|---|
| Device not encrypting | TPM status (Get-Tpm), WinRE (reagentc /info), partition layout, and conflicting policies |
| Encrypted, but no key in Entra ID | The Save to Entra ID setting, the 200-key limit, and the device's Entra registration (dsregcmd /status) |
| Encrypted with the wrong method | The device encrypted before the policy arrived (for example, automatic device encryption during setup). Decrypt and re-encrypt, or accept it. |
| Users asked for a recovery key unexpectedly | Firmware or BIOS updates, Secure Boot changes and docking issues are common triggers. Suspend BitLocker during firmware updates. |
Event logs: Applications and Services Logs > Microsoft > Windows > BitLocker-API, and the BitLocker section of the Encryption report.
FileVault (macOS)¶
| Setting | Recommendation |
|---|---|
| Enable FileVault | Yes |
| Recovery key type | Personal recovery key |
| Escrow location description | Tell users where to get their key, for example "Company Portal website or the IT service desk" |
| Personal recovery key rotation | Every 6 to 12 months |
| Hide recovery key | Yes, so users don't see it during enablement |
| Defer | Enable FileVault at the next sign-out or sign-in, with a limited number of bypasses |
| Force enable in Setup Assistant | Yes for Automated Device Enrollment Macs (macOS 14 and later), so encryption happens before the user reaches the desktop |
Getting keys back:
- Admins: Devices > select the Mac > Recovery keys. The Get FileVault key permission is part of the Help Desk Operator role.
- Users: the Company Portal website shows the key for their own Mac.
- After a key has been used, run the Rotate FileVault key device action.
If a user turned FileVault on before Intune managed the Mac, Intune can't escrow that key until the user uploads it through Company Portal, or you rotate it.
With Platform SSO and the Password authentication method, macOS 15 and later can unlock FileVault with the user's Entra ID password. See Passwordless sign-in.