📋 Overview

BitLocker encrypts the entire OS drive (and optionally removable drives) using AES-128 or AES-256 (XTS mode recommended). The encryption key is protected by one or more key protectors: TPM, TPM+PIN, Recovery Key.

🔑 Key Protectors

📱 Intune Policy (Endpoint Security → Disk Encryption)

🚦 Compliance & Conditional Access

The Disk Encryption profile turns BitLocker on — it does not, by itself, block an unencrypted device from reaching corporate resources. That enforcement comes from a Compliance Policy paired with Conditional Access.

💾 Recovery Key Management

Recovery keys are automatically escrowed to Entra ID when using Intune-managed BitLocker. To retrieve:

# PowerShell – Get BitLocker recovery key from Entra ID
Get-MgDeviceBitLockerRecoveryKey -Filter "deviceId eq 'device-object-id'" |
    Select-Object Id, Key, CreatedDateTime

# Via Entra admin portal:
# Devices → [Device Name] → BitLocker Keys

🙋 Self-Service Recovery via Company Portal

Every recovery key call to the help desk is avoidable overhead. Intune's Company Portal app lets end users retrieve their own BitLocker recovery key directly, without exposing it through IT.

🤫 Silent Encryption

Silent Encryption automatically enables BitLocker without user interaction. Prerequisites:

• Device must have TPM 2.0
• Device must be Modern Standby (HSTI compliant) or have WinPE pre-provisioning
• Device must be Entra Joined or Hybrid Entra Joined
• Recovery key automatically backed up to Entra ID

Used for mass corporate deployment — users don't see any BitLocker prompts.

Autopilot / Enrollment Status Page Timing

On devices without Modern Standby (most desktops and many laptops), silent encryption falls back to encrypting after first sign-in rather than during WinPE — meaning the Disk Encryption profile can still be "processing" for several minutes after the Enrollment Status Page (ESP) completes. Don't gate ESP on the encryption profile finishing; gate it on the required apps only, and let encryption catch up in the background. Devices with WinPE pre-provisioning (used with Autopilot "White Glove") avoid this gap entirely by encrypting before the user ever sees the desktop.

📊 Monitoring Encryption Status

Start with Intune's built-in report — Reports → Device encryption — before reaching for KQL. It shows encryption readiness and status per device out of the box, with no Log Analytics connector required.

# Check BitLocker status on local device
manage-bde -status C:

# KQL – Non-encrypted devices in Intune (Log Analytics / Sentinel)
IntuneDeviceComplianceOrg
| where isEncrypted == false
| where OS == "Windows"
| project DeviceName, UserName, isEncrypted, LastContact
| order by LastContact asc

🛠️ Troubleshooting — Common Failure Reasons

✅ Checklist – BitLocker

📱 Intune Policy
• Create Endpoint Security Disk Encryption policy for Windows
• Set encryption method: XTS-AES 256
• Set encryption type: Used Space Only for new hardware, Full for repurposed devices
• Enable: Save recovery key to Azure AD / Entra ID
• Enable: Require encryption before storing recovery key
• Enable recovery password rotation (Windows 10 2004+ / 11)
🚦 Compliance & Conditional Access
• Create Compliance Policy: Require encryption of data storage on device
• Confirm Conditional Access blocks non-compliant devices from corporate resources
🔒 Security
• Verify TPM 2.0 present on all devices (Intune hardware report)
• Configure PIN for high-security users (IT admins, executives)
• For hybrid-joined fleets, confirm Entra Connect sync frequency is short enough for timely key escrow
🙋 Self-Service
• Confirm Company Portal "Get BitLocker recovery key" is available to reduce help desk load
📊 Monitoring
• Review Intune's native Device encryption report weekly
• Limit BitLocker key viewer access (role-based — BitLocker Key Reader, not Global Admin)
• Alert when compliance drops below 95% encryption rate