Every lost laptop raises the same question: was the drive encrypted, and can you prove it? Deploying BitLocker with Intune answers both. Done properly, devices encrypt silently without the user clicking anything, the recovery key is stored in Microsoft Entra ID, and you have a report that shows the encryption status of every device.
This guide covers the settings for silent encryption, the device prerequisites that cause most failures, how recovery key escrow and rotation work, and how to troubleshoot devices that refuse to encrypt.
Standard vs silent BitLocker
Intune supports two approaches:
Standard encryption: users may see prompts and choose options. It is flexible, but it depends on the user acting, and many never do.
Silent encryption: the device encrypts automatically, with no user interaction and no local admin rights needed. This is the right choice for company-owned devices.
Silent encryption is not the same as Windows automatic device encryption that some hardware performs during setup. Silent encryption is driven by your Intune policy, so you control the encryption method, key protectors and recovery behavior.
Device prerequisites
In my experience, most “BitLocker won’t turn on” tickets come back to one of these:
A TPM (1.2 or 2.0) that is present, enabled in firmware and ready. TPM 2.0 requires UEFI mode.
Windows Recovery Environment (WinRE) enabled. Check with reagentc /info.
A correct partition layout: an NTFS operating system drive and a system partition of at least 350 MB.
Secure Boot enabled. It is not strictly required but strongly recommended, and some failures trace back to it.
The device is Microsoft Entra joined or hybrid joined and enrolled in Intune, so the recovery key can be backed up.
No third-party disk encryption already installed.
Devices imaged years ago with legacy BIOS and MBR disks are the usual problem children. Converting them to UEFI (with mbr2gpt) or reinstalling through Autopilot is often faster than troubleshooting them one by one.
Configuring silent encryption in Intune
Use an endpoint security disk encryption policy. In the Microsoft Intune admin center, go to Endpoint security > Disk encryption > Create Policy, choose Windows and the BitLocker profile.
Setting
Value
Notes
Require Device Encryption
Enabled
Turns on encryption
Allow Warning For Other Disk Encryption
Disabled
Required for silent mode; confirm no third-party encryption first
Allow Standard User Encryption
Enabled
Needed when users are not local admins
Configure Recovery Password Rotation
Refresh on for Entra joined devices
Rotates the recovery password after it is used
Choose drive encryption method and cipher strength
XTS-AES 128 or 256 for OS and fixed drives
Pick one standard and keep it consistent
Startup authentication: TPM startup PIN or key
Do not allow
A startup PIN or key requires user interaction and breaks silent mode
Save BitLocker recovery information to Microsoft Entra ID
Enabled
Escrows the key
Do not enable BitLocker until recovery information is stored
Enabled
Prevents encryption without a backed-up key
That last setting is the one I insist on. A device encrypted without an escrowed key is one forgotten PIN or firmware change away from permanent data loss.
Assign the policy to a device group, not a user group, so encryption follows the hardware. Pilot it with a handful of devices first and check the results before going wide.
Watch for conflicting policies
BitLocker settings also appear in security baselines and older endpoint protection configuration profiles. If two policies set different encryption methods or startup authentication options, the device can stall. Keep BitLocker in one policy and remove it from the others.
Recovery key escrow and access
With silent encryption, the recovery key is backed up to Microsoft Entra ID automatically when the drive is encrypted. You can find it in three places:
In the Intune admin center: Devices > All devices > [device] > Recovery keys.
In the Microsoft Entra admin center, on the device object.
In the encryption report at Devices > Monitor > Encryption report, which also shows each device’s encryption readiness and status.
Viewing a recovery key is an audited action. Limit who can do it with role-based access control. Helpdesk staff who reset passwords do not automatically need BitLocker key access.
Users can also retrieve their own recovery key from the Company Portal website or from the My Account portal for devices they own, which saves a call to IT when the BitLocker recovery screen appears after a firmware update.
Key rotation
Once a recovery password has been read out over the phone, treat it as exposed. With recovery password rotation enabled, Entra joined devices generate a new password after it is used, and you can trigger a rotation manually from the device in Intune with the BitLocker key rotation action.
Troubleshooting devices that will not encrypt
Start with the encryption report. Each device lists the reasons it is not ready or not compliant. The ones I see most often:
WinRE not configured. Run reagentc /enable, or fix the recovery partition.
TPM not ready or not available. Check firmware settings and the TPM management console. Clear and initialize the TPM if needed.
Standard user cannot encrypt. Allow Standard User Encryption is missing or set incorrectly.
Recovery key backup failed. Usually a network or device registration issue. Check dsregcmd /status and the BitLocker-API event log in Event Viewer.
Startup PIN required by another policy. Remove the conflicting setting.
Pair the encryption policy with a compliance policy that requires BitLocker. Devices that fail to encrypt then show up as noncompliant, and with Conditional Access they cannot reach company data until the problem is fixed.
Frequently asked questions
Does BitLocker in Intune require Windows Enterprise?
No. BitLocker policies, including silent encryption, work on Windows Pro, Enterprise and Education devices that are enrolled in Intune. Microsoft 365 Business Premium includes everything needed for most small businesses.
Where are BitLocker recovery keys stored when using Intune?
In Microsoft Entra ID, attached to the device object. Admins with the right permissions can view them in the Intune or Entra admin centers, and users can retrieve keys for their own devices through self-service portals.
Why does BitLocker ask users for input when silent encryption is configured?
Usually because a policy requires a TPM startup PIN or key, a warning about other disk encryption is still allowed, or another baseline sets conflicting BitLocker options. Remove those settings so no user interaction is needed.
Every lost laptop raises the same question: was the drive encrypted, and can you prove it? Deploying BitLocker with Intune answers both. Done properly, devices encrypt silently without the user clicking anything, the recovery key is stored in Microsoft Entra ID, and you have a report that shows the encryption status of every device.
This guide covers the settings for silent encryption, the device prerequisites that cause most failures, how recovery key escrow and rotation work, and how to troubleshoot devices that refuse to encrypt.
Standard vs silent BitLocker
Intune supports two approaches:
Silent encryption is not the same as Windows automatic device encryption that some hardware performs during setup. Silent encryption is driven by your Intune policy, so you control the encryption method, key protectors and recovery behavior.
Device prerequisites
In my experience, most “BitLocker won’t turn on” tickets come back to one of these:
reagentc /info.Devices imaged years ago with legacy BIOS and MBR disks are the usual problem children. Converting them to UEFI (with
mbr2gpt) or reinstalling through Autopilot is often faster than troubleshooting them one by one.Configuring silent encryption in Intune
Use an endpoint security disk encryption policy. In the Microsoft Intune admin center, go to
Endpoint security > Disk encryption > Create Policy, choose Windows and the BitLocker profile.That last setting is the one I insist on. A device encrypted without an escrowed key is one forgotten PIN or firmware change away from permanent data loss.
Assign the policy to a device group, not a user group, so encryption follows the hardware. Pilot it with a handful of devices first and check the results before going wide.
Watch for conflicting policies
BitLocker settings also appear in security baselines and older endpoint protection configuration profiles. If two policies set different encryption methods or startup authentication options, the device can stall. Keep BitLocker in one policy and remove it from the others.
Recovery key escrow and access
With silent encryption, the recovery key is backed up to Microsoft Entra ID automatically when the drive is encrypted. You can find it in three places:
Devices > All devices > [device] > Recovery keys.Devices > Monitor > Encryption report, which also shows each device’s encryption readiness and status.Viewing a recovery key is an audited action. Limit who can do it with role-based access control. Helpdesk staff who reset passwords do not automatically need BitLocker key access.
Users can also retrieve their own recovery key from the Company Portal website or from the My Account portal for devices they own, which saves a call to IT when the BitLocker recovery screen appears after a firmware update.
Key rotation
Once a recovery password has been read out over the phone, treat it as exposed. With recovery password rotation enabled, Entra joined devices generate a new password after it is used, and you can trigger a rotation manually from the device in Intune with the BitLocker key rotation action.
Troubleshooting devices that will not encrypt
Start with the encryption report. Each device lists the reasons it is not ready or not compliant. The ones I see most often:
reagentc /enable, or fix the recovery partition.dsregcmd /statusand the BitLocker-API event log in Event Viewer.Pair the encryption policy with a compliance policy that requires BitLocker. Devices that fail to encrypt then show up as noncompliant, and with Conditional Access they cannot reach company data until the problem is fixed.
Frequently asked questions
Does BitLocker in Intune require Windows Enterprise?
No. BitLocker policies, including silent encryption, work on Windows Pro, Enterprise and Education devices that are enrolled in Intune. Microsoft 365 Business Premium includes everything needed for most small businesses.
Where are BitLocker recovery keys stored when using Intune?
In Microsoft Entra ID, attached to the device object. Admins with the right permissions can view them in the Intune or Entra admin centers, and users can retrieve keys for their own devices through self-service portals.
Why does BitLocker ask users for input when silent encryption is configured?
Usually because a policy requires a TPM startup PIN or key, a warning about other disk encryption is still allowed, or another baseline sets conflicting BitLocker options. Remove those settings so no user interaction is needed.
BitLocker is a core control in our endpoint security baseline, and the Intune health check flags devices that are not encrypted. For healthcare environments, see our healthcare IT services. Microsoft’s full reference is Encrypt Windows devices with BitLocker using Intune.
Could you prove today that every laptop is encrypted and every key is escrowed? Find out with a free Microsoft 365 security assessment.