Endpoint management
BitLocker
Microsoft BitLocker
BitLocker is Windows' built-in full-volume disk encryption feature, encrypting an entire drive, typically the operating system volume and any fixed data drives, so that the data on it is unreadable without the correct recovery key or an authorised unlock method.
Why BitLocker matters in a Microsoft estate
BitLocker matters for endpoint teams because device, app, compliance, update, and troubleshooting signals often sit across several Microsoft admin areas. Linking these terms back to Intune and device-reporting routes helps readers move from definition to action.
How BitLocker shows up in practice
It protects against the specific scenario of a lost or stolen device giving an attacker with physical possession direct access to the data on disk by removing the drive or booting from external media. It typically pairs with a device's Trusted Platform Module, TPM, which stores the encryption keys in hardware and validates the boot chain hasn't been tampered with before releasing them. A correctly configured BitLocker device unlocks transparently for the legitimate user at sign-in without a separate BitLocker prompt, while a device with a missing or failed TPM check, or one booted from unexpected media, halts into recovery mode requiring the 48-digit recovery key.
In a managed Microsoft 365 estate, BitLocker is configured and enforced through Microsoft Intune, either via a dedicated endpoint security disk encryption policy or through configuration profiles. Critically, recovery keys are escrowed automatically to Entra ID (or Active Directory in hybrid-joined scenarios) as part of that managed configuration, which is the detail that turns BitLocker from a security control into an operational risk if it's missed: a device encrypted without its recovery key properly escrowed anywhere accessible to IT is one boot failure or forgotten password away from permanently inaccessible data, since there is no backdoor or master key that bypasses BitLocker by design.
Silent enablement, encrypting a device automatically as part of Autopilot provisioning without an interactive prompt, is standard practice in managed estates and depends on the TPM and hardware meeting Modern Standby or HSTI requirements. Devices that don't meet those requirements fall back to a slower, interactive encryption prompt or, in poorly configured environments, don't get encrypted at all without anyone noticing, which is a genuine compliance gap since BitLocker status is one of the checks most commonly required by compliance policies feeding Conditional Access, and a device silently failing to encrypt can still pass other compliance checks if BitLocker specifically isn't in the evaluated policy.
BitLocker is also central to several UK and sector-specific compliance obligations, including Cyber Essentials' expectations around protecting data on portable and removable devices. It's a frequent audit finding that encryption status is enforced by policy but not actually verified in reporting, since a compliance policy can mark a device non-compliant for missing encryption while dashboards used for day-to-day operations don't surface that specific failure clearly, leaving genuinely unencrypted devices in circulation for longer than the policy configuration would suggest.