Microsoft Intune - Bitlocker encryption Co-managed devices (fixed data drive)

Question

Hello,

We have enabled Co-management and all devices are hybrid Azure AD joined. I configured Windows 10 Device configuration (Endpoint Protection Profile).

I encrypted OS drive without any problems. After that i configured policy to encrypt fixed data drive, after that i receive such error in Event Viewer (Bitlocker-API)

851 Silently Enctryption failed, Access Denied
]1

This is my configuration. What could be the cause? Second partition is formatted and enabled. No additional CD/DVD drive or something like that.

Answer 1

@Eduards , From your description, I know we get silently encryption failure when configure Bitlocker for fixed data drive on Windows 10 Device configuration policy. if there's any misunderstanding, feel free to let us know.

I know the devices are all Hybrid Azure AD joined. In fact, silently enable BitLocker on devices is only supported on Azure AD joined devices. As our devices are all Hybrid Azure AD joined, this may cause our issue.

https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices#manage-bitlocker

Turn off bitlocker, Change "Allow standard users to enable encryption during Azure AD Join" to not configured, and then assign the policy again, Then the disks are encrypted correctly.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hello @Crystal-MSFT

Thank you for your answer.

But there should be a way to encrypt fixed data drive using Microsoft Intune on Hybrid Azure AD joined devices?

Answer 3

Hello @Crystal-MSFT - i turned off bitlocker on test laptop and then changed policy settings and deployed again.

And after that all 2 disks were encrypted.