Skip to main content

182: FileVault encryption

Implementation Effort: Medium
User Impact: Medium

Overview​

FileVault provides full-disk encryption for macOS and is a foundational control for protecting data at rest on corporate-managed Macs. In a Zero Trust device program, FileVault reduces the impact of device loss or theft and helps ensure that local data is not easily exposed outside approved access paths.

A good FileVault deployment plan covers enablement timing, recovery key escrow, user communication, and support procedures. Encryption should be part of the standard enrollment and provisioning model for corporate-owned Macs unless a documented exception exists.

Implementation Guidance​

Define the encryption standard​

  • Decide which Macs must use FileVault, whether enablement should be immediate or deferred for a limited number of sign-ins, and how recovery keys will be escrowed and accessed.
  • Establish who may retrieve recovery keys and how those retrievals will be audited.
  • Review interactions with local account creation, Platform SSO, and break-glass admin accounts before rollout.

Configure FileVault in Intune​

  • Create the supported macOS FileVault or endpoint security disk encryption profile in the Microsoft Intune admin center.
  • Configure recovery key settings and assign the profile to pilot devices first to validate the end-user experience and escrow flow.
  • Confirm that recovery keys are visible where expected and that support staff know how to handle recovery events securely.

Operate and support​

  • Monitor encryption status and investigate devices that do not complete enablement or escrow their recovery key.
  • Document recovery procedures for password reset, hardware repair, and employee departure scenarios.
  • Review exceptions such as lab devices or shared devices separately so they do not weaken the baseline standard.

Video Walkthrough​

Reference​