How to Enable and Configure BitLocker Using Microsoft Intune

Start by signing into the Microsoft Intune admin center where you'll configure BitLocker policies. This is the centralized location for all endpoint security configurations.

Open your web browser and navigate to https://endpoint.microsoft.com. Sign in with your administrator credentials that have Intune device configuration permissions.

Once logged in, navigate to Endpoint security in the left navigation pane, then select Disk encryption. This section contains all encryption-related policies for your managed devices.

Create a dedicated BitLocker policy using the recommended Endpoint Security method. This approach provides a streamlined interface specifically designed for encryption management.

Click Create policy in the Disk encryption section. In the policy creation wizard:

• Set Platform to Windows 10 and later
• Set Profile to BitLocker
• Click Create

On the Basics tab, configure the following:

Name: EndpointSecurity-BitLocker-Production
Description: BitLocker encryption policy for Windows 10/11 devices with silent enablement

Click Next to proceed to configuration settings.

Configure the essential BitLocker settings that enable silent encryption without user interaction. These settings are crucial for enterprise deployments where you want encryption to happen automatically.

In the Configuration settings section, configure these key options:

BitLocker Options:

Require Device Encryption: Enabled
Allow Warning For Other Disk Encryption: Disabled
Allow standard users to enable encryption during Entra ID join: Enabled

Operating System Drives:

Silently enable BitLocker on devices with TPM: Enabled
Encryption method for operating system drives: XTS-AES 256-bit
Minimum PIN length: 6 (if using PIN authentication)
Configure recovery password rotation: Enabled

Fixed Data Drives:

Encryption method for fixed data drives: XTS-AES 256-bit
Deny write access to fixed drives not protected by BitLocker: Enabled

The XTS-AES 256-bit encryption method provides the strongest security while maintaining good performance on modern hardware.

Set up proper recovery key management to ensure users can recover their data if they forget passwords or encounter hardware issues. Recovery keys are automatically stored in Microsoft Entra ID.

Configure these recovery settings in the same Configuration settings section:

Recovery options for operating system drives:
- Configure recovery password rotation: Enabled
- Rotation frequency: 180 days
- Save BitLocker recovery information to Azure Active Directory: Enabled
- Recovery information to store: Recovery passwords and key packages
- Allow recovery information to be stored before enabling BitLocker: Required

For additional security, configure these advanced recovery options:

Hide recovery options during BitLocker setup: Enabled
Enable recovery information to be stored before enabling BitLocker: Required
Block the use of certificate-based data recovery agent: Enabled

These settings ensure that recovery keys are safely stored in the cloud before encryption begins, preventing lockout scenarios.

Assign your BitLocker policy to specific groups of devices or users. Proper group assignment ensures the policy deploys only to intended devices and prevents conflicts.

Click Next to reach the Scope tags section. If you use scope tags for role-based administration, assign appropriate tags. Otherwise, click Next to continue.

On the Assignments tab, configure your target groups:

1. Click Add groups under Included groups
2. Search for and select your target device groups (e.g., "Windows-Workstations" or "Finance-Laptops")
3. Click Select

For testing, start with a small pilot group:

Included groups: BitLocker-Pilot-Devices (10-20 devices)
Excluded groups: BitLocker-Exceptions (devices that shouldn't be encrypted)

You can assign to both user groups and device groups. Device groups are generally preferred for encryption policies as they ensure consistent application regardless of who logs in.

Complete the policy creation process and deploy it to your selected devices. This final step activates the BitLocker encryption across your managed endpoints.

On the Review + create tab, carefully review all your configuration settings:

• Policy name and description
• Platform and profile type (Windows 10 and later, BitLocker)
• All configuration settings you've defined
• Target group assignments

If everything looks correct, click Create to deploy the policy.

After creation, the policy will appear in your Disk encryption policies list with a status of "Deploying" or "Active".

Monitor the initial deployment by navigating to Devices > Monitor > Encryption report. This report shows:

Device encryption status:
- Encrypted: Devices with BitLocker successfully enabled
- Ready: Devices that meet requirements but encryption hasn't started
- Not applicable: Devices that don't support BitLocker
- Error: Devices with deployment failures

Confirm that BitLocker is properly deployed and functioning on your target devices. This verification step ensures the policy worked correctly and encryption is active.

On a target device, open Command Prompt as administrator and run:

manage-bde -status

You should see output similar to:

BitLocker Drive Encryption: Configuration Tool version 10.0.22000
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

Volume C: [Windows]
[OS Volume]

    Size:                 476.84 GB
    BitLocker Version:    Windows 10
    Conversion Status:    Used Space Only Encrypted
    Percentage Encrypted: 100%
    Encryption Method:    XTS-AES 256
    Protection Status:    Protection On
    Lock Status:          Unlocked
    Identification Field: Unknown
    Key Protectors:       TPM

Additionally, verify in the Intune admin center:

1. Navigate to Devices > All devices
2. Select a target device
3. Check the Encryption section in device properties
4. Confirm status shows "Encrypted" and recovery key is stored

You can also verify recovery keys are properly stored by checking Devices > Monitor > Encryption report for detailed device-by-device status.

Create compliance policies that enforce BitLocker encryption and take action on non-compliant devices. This ensures ongoing security compliance across your organization.

Navigate to Devices > Compliance policies > Create policy. Configure the following:

Platform: Windows 10 and later
Name: BitLocker-Compliance-Policy
Description: Enforce BitLocker encryption on all managed Windows devices

In the Device Health section, configure:

Require BitLocker: Require
Require Secure Boot to be enabled on the device: Require
Require code integrity: Require

Set up actions for noncompliance in the Actions for noncompliance section:

Action: Mark device noncompliant
Schedule: Immediately

Action: Send email to end user
Schedule: 1 day after noncompliance

Action: Block access to company resources
Schedule: 7 days after noncompliance

Assign this compliance policy to the same groups as your BitLocker encryption policy to ensure consistent enforcement.

Address the most common issues that occur during BitLocker deployment through Intune. Understanding these problems helps you resolve them quickly when they arise.

TPM and Hardware Issues:

If devices show "Not applicable" status, check TPM availability:

tpm.msc

Common solutions:

• Enable TPM in BIOS/UEFI settings
• Ensure UEFI mode is enabled (not Legacy BIOS)
• Update TPM firmware if using TPM 1.2 on Windows 11

Pre-existing Encryption Conflicts:

If third-party encryption is detected, decrypt the drive first:

manage-bde -off C:

Wait for decryption to complete before applying the Intune policy.

Policy Conflicts:

Check for conflicting policies by reviewing:

• Devices > Configuration profiles - Look for multiple encryption policies
• Endpoint security > Disk encryption - Ensure only one active BitLocker policy per device group

Standard User Permission Issues:

For Windows 10 devices earlier than 1809, standard users cannot enable BitLocker during Entra ID join. Solutions:

• Upgrade to Windows 10 1809 or later
• Use administrator accounts for initial setup
• Enable the "Allow standard users to enable encryption during Entra ID join" setting