'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Configure BitLocker Policy in Intune for Hybrid Azure AD Devices
Question details
The user needs to deploy and manage BitLocker encryption on hybrid Azure AD-joined devices using Microsoft Intune.
- Product
- Microsoft Intune
- Device & OS
- Windows
- Scenario
- Securing hybrid Azure AD-joined devices with BitLocker through enterprise endpoint management.
- Observed behavior
- Seeking correct configuration steps and policy requirements to successfully enforce BitLocker encryption.
Ensure you have Intune Administrator permissions and your hybrid Azure AD-joined devices meet the minimum Windows version and TPM requirements for BitLocker.
Create a BitLocker Policy via Intune Endpoint Security
The most direct method to deploy BitLocker is by using the Endpoint Security disk encryption profiles in the Microsoft Intune admin center.
Configuring BitLocker through Endpoint Security allows administrators to silently enable encryption, backup recovery keys to Azure AD, and define user prompts without relying on traditional Group Policy Objects (GPOs).
Sign in to the Microsoft Intune admin center and navigate to Endpoint security > Disk encryption.
Click 'Create Policy', choose 'Windows 10 and later' for the platform, and select 'BitLocker' for the profile. Click Create.
In the configuration settings, enable 'Require Device Encryption' and configure 'Allow warning for other disk encryption' to 'Block' to facilitate silent encryption.
Assign the created profile to the appropriate Azure AD device groups containing your hybrid joined devices, then review and save the policy.
Seek Expert Guidance on Microsoft Q&A
For complex hybrid environments, overlapping policies, or specific error codes, consulting Microsoft experts is highly recommended.
Boost Productivity with WPS Office on Managed Devices
While securing your devices with Microsoft Intune and BitLocker, equip your team with a lightweight and powerful office suite. WPS Office is a free, enterprise-friendly alternative to Microsoft Office that easily handles your document needs.
- 1. Download Installer: Visit the official WPS Office website and download the offline installer for Windows.
- 2. Deploy via Intune: Wrap the installer as a Win32 app and deploy it seamlessly to your endpoint devices via Microsoft Intune.
- 3. Start Working: Open WPS Office to instantly edit your Word, Excel, and PowerPoint files without formatting issues.
Frequently Asked Questions
Why is BitLocker not silently encrypting my hybrid Azure AD-joined devices?
Silent encryption may fail if the device lacks a compatible TPM chip, is not running a supported Windows version, has conflicting Group Policies (GPOs), or if third-party encryption software is already installed.
Do I need a specific license to manage BitLocker in Intune?
Yes, managing BitLocker through Intune requires a license that includes Microsoft Intune, such as Microsoft 365 Business Premium, Enterprise E3, or E5.
How can I verify that the BitLocker policy applied successfully in Intune?
In the Intune admin center, navigate to Endpoint security > Disk encryption, select your BitLocker policy, and view the Device status report. A status of 'Succeeded' indicates the policy was applied and the device is encrypted.
Can I recover BitLocker keys from Azure AD for hybrid joined devices?
Yes, if configured in your Intune BitLocker policy, devices will automatically back up their recovery keys to Azure AD. Administrators can view these keys in the Azure portal under the specific device's properties.
