Skip to main content

159: MDM based policies for BitLocker

Implementation Effort: Medium
User Impact: Medium

Overview​

BitLocker helps protect data at rest on Windows devices by encrypting operating system and fixed data drives. In a Zero Trust device strategy, BitLocker reduces the impact of device loss or theft and supports the expectation that a compromised device should not expose locally stored business data.

For Intune-managed Windows devices, BitLocker planning should cover silent enablement, encryption strength, recovery key escrow, support processes, and the relationship between encryption state and Conditional Access or compliance decisions.

Implementation Guidance​

Define the desired encryption posture​

  • Decide which device types must use BitLocker, whether encryption should be silent where hardware supports it, and whether XTS-AES 128-bit or 256-bit is required by policy.
  • Confirm prerequisites such as supported Windows editions, TPM availability, firmware readiness, and whether removable or fixed data drives need separate handling.
  • Define who is allowed to retrieve recovery keys and how recovery events will be audited.

Configure BitLocker in Intune​

  • Use the Disk encryption workload in endpoint security or an equivalent Windows configuration profile in Intune, and standardize on one management approach for the target population.
  • Require recovery key escrow to Microsoft Entra ID before broad rollout, and test recovery from the administrator and end-user perspectives.
  • Pair encryption configuration with a compliance policy that checks the encryption state where appropriate, but do not block access until reporting confirms the deployment is healthy.

Operate and support​

  • Use Intune and Microsoft Entra reporting to verify encryption status and to locate recovery keys during support events.
  • Document break-glass recovery procedures for motherboard replacement, firmware changes, and repeated recovery prompts.
  • Review exceptions for virtual machines, kiosks, labs, and legacy hardware separately rather than weakening the global standard.

Reference​