BitLocker disk encryption protects company data if a device is lost or stolen. Managing it through Intune means every enrolled Windows device is encrypted — and recovery keys are stored centrally.
Key takeaways
- 1Encryption required — devices that don't have BitLocker enabled are flagged as non-compliant
- 2Encryption algorithm — Optimyze enforces AES-256 for all managed devices
- 3Recovery key escrow — BitLocker recovery keys are automatically stored in Entra ID, accessible to admins in the portal (not on paper, not in a spreadsheet)
- 4Startup authentication — optional PIN or USB key requirement before Windows loads
A lost or stolen unencrypted laptop is a data breach. The files on the disk are readable by anyone with physical access — regardless of the Windows login password. BitLocker disk encryption is the standard solution, and managing it through Intune means you can enforce encryption across every Windows device without visiting each machine.
How Intune manages BitLocker
Intune's Endpoint Security policy for Disk Encryption manages BitLocker configuration:
- Encryption required — devices that don't have BitLocker enabled are flagged as non-compliant
- Encryption algorithm — Optimyze enforces AES-256 for all managed devices
- Recovery key escrow — BitLocker recovery keys are automatically stored in Entra ID, accessible to admins in the portal (not on paper, not in a spreadsheet)
- Startup authentication — optional PIN or USB key requirement before Windows loads
Recovery key management
The biggest operational risk with BitLocker is recovery key management. If a device has hardware issues or a user forgets their PIN, the recovery key is needed to decrypt the drive. With Intune-managed BitLocker, recovery keys for every device are stored in Entra ID — Optimyze can retrieve the key for any managed device in seconds, without needing to know where it was saved.
What happens to non-compliant devices
Devices without BitLocker enabled are flagged in Intune compliance reports and can be blocked from accessing Microsoft 365 via Conditional Access until they encrypt. In practice, most modern Windows 11 devices support automatic BitLocker Device Encryption, which Intune triggers on enrolment — no user action required.
