🎯 Purpose
✅ Enforce BitLocker disk encryption on all Windows devices using the Endpoint security › Disk encryption template.
➡️ Replaces IBP - DfB - Windows - BitLocker (OS), which used the legacy Endpoint Protection template. The existing BitLocker settings are carried over unchanged, and recovery key handling is strengthened.
👥 Who is affected
✅ Devices: All Windows 10 / 11 devices
🚫 Exclusions: None
➡️ Every enrolled Windows device must encrypt its operating system drive.
💽 What is protected
✅ Disk: Operating system drive (encryption enforced)
✅ Encryption strength: XTS‑AES 256‑bit
✅ Hardware protection: TPM‑based startup authentication
✅ Recovery: OS and fixed drive recovery information escrowed to Entra ID
➡️ If a device is lost or stolen, data on the OS drive remains unreadable.
🔐 How BitLocker is enforced
Setting | Value |
Require device encryption (OS drive) | Enabled |
Encryption method (OS drive) | XTS‑AES 256‑bit |
Startup authentication | TPM required; startup key, TPM + PIN and TPM + key not allowed |
OS drive – Save BitLocker recovery information to Entra ID | Enabled; escrow required before encryption completes |
Fixed drives – Save BitLocker recovery information to Entra ID | Enabled (recovery passwords and key packages) |
Configure Recovery Password Rotation | Enabled for Entra ID‑joined devices |
➡️ Recovery keys are always available to administrators and are rotated after use, so a disclosed key cannot be reused.
ℹ️ Note: A restart is required to enable TPM and begin encryption when the policy is first applied.
⚙️ What this policy does NOT enforce
🚫 Fixed drive encryption enforcement (recovery escrow only)
🚫 Removable drive encryption
🚫 Pre‑boot PIN
🚫 Defender, ASR or firewall settings
➡️ The policy stays focused on disk encryption and recovery.
🟢 Policy status
✅ Enabled
✅ Assigned to all devices
✅ Actively enforcing OS disk encryption
📘 Essential Eight Alignment
✅ Protects data at rest on all Windows devices
✅ Recovery information is centrally stored and rotated
ℹ️ Inforcer Best Practice control applied at all maturity levels
📘 Practical Interpretation (Executive‑Friendly)
This policy ensures that:
✅ Every Windows device is encrypted
✅ IT can always recover a locked device
✅ Recovery keys are not left valid after they have been used
This provides a modern, supportable encryption baseline on the current Intune template.