Why doesn’t Intune support forcing BitLocker PIN after deployment like MBAM did?

Question

Why doesn’t Intune support forcing BitLocker PIN after deployment like MBAM did?

Belan Marek 56

Hello,

We used MBAM for years because it had a unique feature: it could enforce TPM+PIN after a certain time or immediately after deployment. This was critical for our security policy.

Now that MBAM is deprecated and we are moving to Intune/ConfigMgr BitLocker Management, we noticed that Intune cannot force users to set a BitLocker PIN interactively after OS installation. The only options are:

Require TPM+PIN from the start (static policy).
No built-in mechanism to prompt the user later or enforce PIN rotation.

Questions:

Why doesn’t Intune have this functionality? Is there a roadmap for adding it?
What is the recommended way to achieve similar behavior now?
- GPO can require TPM+PIN, but it doesn’t prompt the user.
  - We can script it with Add-BitLockerKeyProtector -TpmAndPinProtector, but that feels like a workaround.

Has anyone implemented a clean solution for this in an Intune-managed environment? Any official guidance from Microsoft on replacing MBAM’s PIN enforcement feature?

Thanks!

Rahul Jindal 11,501 Reputation points

2025-12-03T11:32:02.73+00:00

This is by design and very much intentional. The rationale is that the Windows OS relies to use TPM backed protector as default. The startup PIN adds no additional cryptographic protection against most practical cloud-managed threat models therefore does not align with Modern Zero trust model
Belan Marek 56 Reputation points

2025-12-04T07:04:07.9233333+00:00

When some one stole NB, all data is decrypted when he turn it on. This is why PIN is there !!!
Mohammed Sajid 6 Reputation points

2025-12-04T10:00:15.0533333+00:00

Hi Belan,

Not natively as forcing a BitLocker Pin is note a native capability, built into Microsoft Intune. You can combine Intune config and PowerShell Script to possibly achieve this.

I have come across this blog post before that might offer you some insight.

https://localerror.com/intune/deploying-bitlocker-with-a-startup-pin-through-intune-and-powershell/

Your answer

Rahul Jindal 11,501 Reputation points

2025-12-03T11:32:02.73+00:00

This is by design and very much intentional. The rationale is that the Windows OS relies to use TPM backed protector as default. The startup PIN adds no additional cryptographic protection against most practical cloud-managed threat models therefore does not align with Modern Zero trust model
Belan Marek 56 Reputation points

2025-12-04T07:04:07.9233333+00:00

When some one stole NB, all data is decrypted when he turn it on. This is why PIN is there !!!
Mohammed Sajid 6 Reputation points

2025-12-04T10:00:15.0533333+00:00

Hi Belan,

Not natively as forcing a BitLocker Pin is note a native capability, built into Microsoft Intune. You can combine Intune config and PowerShell Script to possibly achieve this.

I have come across this blog post before that might offer you some insight.

https://localerror.com/intune/deploying-bitlocker-with-a-startup-pin-through-intune-and-powershell/

Share via

Why doesn’t Intune support forcing BitLocker PIN after deployment like MBAM did?

Your answer