Intune Bitlocker Encryption

Question

We have set up a policy for disk encryption to encrypt devices within a group scope using bitlocker. The devices are Hybrid Entra ID joined and enrolled to Intune using device credentials as we have co-management setup with SCCM.

Recovery Keys are stored in AAD.

Sometimes certain users mistakenly can encrypt devices manually from Bitlocker management on the device itself or using third party tools such as cisco anyconnect, This does not store the recovery key in Azure which in case recovery screen is triggered will render the device useless and need a re-image.

My question is, How to do we block any sort of Bitlocker Encryption Outside of the Intune policy as this is important for consistent behaviours.

Answer 1

@Ahmed Sh Thanks for posting in our Q&A.

Honestly, there is no setting that can make it. If you are interested in this feature, it is suggested to post in intune feedback portal. This is a place to collect customers' requirements and questions. Hope it will achieve in the future.

https://feedbackportal.microsoft.com/feedback/forum/ef1d6d38-fd1b-ec11-b6e7-0022481f8472

Thanks for your understanding.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.