The best way to enable Bitlocker via Intune

Question

Hi experts,

We are moving our Windows 10 device from on-promise SCCM to Intune now. We want to know how many ways to enable Bitlocker using Intune. What is the best one or your recommendation?

Answer 1

It depends.... you can do so by using a powershell script or just the build in options (endpoint security) or a device configuration profile.

A lot of options :)

Answer 2

We use a Disk encryption policy/profile (what used to be a device configuration profile) along with a compliance policy to implement and enforce Bitlocker on our devices.

You will now create one in Endpoint Manager > Endpoint security > Disk encryption > Create Policy

Here's ours for an example:

---

Please accept as an answer if this was helpful.

Answer 3

Hi,

Thank you for posting in Microsoft Q&A forum.

The following two policy types are most commonly used to configure BitLocker on Windows devices in Intune. You can choose either one according to your organization.

1,Endpoint security disk encryption policy for BitLocker. The BitLocker profile in Endpoint security is a focused group of settings that is dedicated to configuring BitLocker.

2,Device configuration profile for endpoint protection for BitLocker. BitLocker settings are one of the available settings categories for Windows 10/11 endpoint protection.

For more information, please refer to the official article:

https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices

Thanks for your time. Have a nice day!

Best regards,

Simon

---

If the response is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

https://docs.microsoft.com/en-us/answers/articles/67444/email-notifications.html