🎯 Purpose
✅ Turn on FileVault disk encryption on all macOS devices and escrow the recovery key to Intune.
➡️ E8‑COMPLY‑MacOS requires FileVault, but nothing previously switched it on. This policy lets devices meet that compliance check.
👥 Who is affected
✅ Devices: All macOS devices
🚫 Exclusions: None
💽 What is protected
✅ Disk: macOS startup volume
✅ Template: Endpoint security › Disk encryption › macOS FileVault
🔐 How FileVault is enforced
Setting | Value |
Enable FileVault | On |
Defer (enable at next login) | Enabled |
Max bypass attempts at login | 0 (cannot be skipped) |
Use Recovery Key (personal recovery key) | Enabled – escrowed to Intune |
Show Recovery Key to user | Disabled |
Recovery Key Rotation | Every 6 months |
Recovery key escrow location message | Tells users to contact IT or use Company Portal to retrieve the key (shown on the Mac login screen) |
➡️ FileVault turns on at the user's next login with no option to skip. The recovery key is held by IT, not shown to the user.
⚙️ What this policy does NOT enforce
🚫 Institutional recovery keys
🚫 Encryption of external drives
🚫 Firewall or Gatekeeper settings
🟢 Policy status
✅ Enabled
✅ Assigned to all devices
📘 Essential Eight Alignment
✅ Protects data at rest on macOS devices
✅ Lets devices pass the FileVault check in E8‑COMPLY‑MacOS
ℹ️ Inforcer Best Practice control applied at all maturity levels
📘 Practical Interpretation (Executive‑Friendly)
This policy ensures that:
✅ Every Mac is encrypted
✅ IT can always unlock a Mac if a user is locked out
✅ Lost or stolen Macs don't expose company data