BitLocker Design

BitLocker provides full-volume encryption for Windows devices, protecting data at rest against device loss or theft. In cloud-managed estates it is deployed and monitored through Intune disk encryption endpoint security policies with recovery key escrow to Microsoft Entra ID.

When to use

Encrypting Windows endpoints and centrally managing recovery keys and compliance. Use this skill to choose pre-boot mode, configure silent enablement, and plan recovery before rollout.

Do not use this skill for general Intune device baseline (intune-device-mgmt), macOS FileVault (use Intune disk encryption policy directly), or Azure VM disk encryption (azure-key-vault).

Pick the configuration by device type