configure windows recovery environment for bitlocker

From here, choose Create PolicyĬhoosing to hide prompt about third-party encryption is a prerequisite to silent encryption, which is an automated approach that does not require end-user intervention. Endpoint security profile – configuration settingsīitLocker endpoint security profiles are set up in Endpoint security > Manage > Disk encryption. Disk encryption is not the kind of policy you want to always follow a user as they move from device to device, and may lead to unintended encryption. In all scenarios, choose to assign your Intune settings to devices rather than users. Therefore, this best-practice guide relies on both profile types. However, not all configuration possibilities are available in it. Endpoint security profiles are the newer type of Intune profile, with the intent being you can manage all your security rules in a dedicated part of MEM. Both profile types ultimately configure the same background settings, but with a different user interface. The settings for BitLocker are exposed in two Microsoft Endpoint Manager (MEM) areas: endpoint security profiles and configuration profiles. Following this article, you can configure BitLocker encryption to best-practice for reliable, secure disk encryption in your environment.

Some are unintuitive, some cause conflicts, and some are even hidden. There is a wealth of settings in Intune for BitLocker. Existing devices will be encrypted as soon as the device checks in with Intune to pull down the configuration. If you are deploying devices with Autopilot, this will also allow you to encrypt them at the time of deployment. To protect data at rest on your Intune-managed Windows devices, BitLocker disk encryption can be applied automatically using the BitLocker CSP.

Configure windows recovery environment for bitlocker