Macs are no longer the exception in most offices. Designers, executives and developers often carry them, and they hold the same client data as any Windows laptop. Enforcing FileVault with Intune gives you the same protection you expect from BitLocker: full disk encryption on every company Mac, a recovery key escrowed in Intune, and a self-service way for users to get back in when they forget their password.
This guide covers the prerequisites, the two ways to deploy FileVault from Intune, how key escrow and rotation work, and the user experience details that decide whether your rollout is smooth or noisy.
Prerequisites
User-approved or automated device enrollment. Since macOS 10.15, FileVault configuration through MDM requires user-approved enrollment. Devices enrolled through Apple Business Manager with automated device enrollment meet this automatically.
Supported macOS version. Keep Macs on a supported release; some FileVault options, such as Setup Assistant enforcement, need macOS 14 or later.
Ownership set correctly. Mark company Macs as Corporate in Intune. Admins can only view escrowed recovery keys for corporate devices, not personal ones.
Intune RBAC. Decide who can view and rotate keys. Viewing requires the remote tasks permissions for FileVault key access, and each view is audited.
Option 1: Endpoint security disk encryption policy
This is the simplest route and the one I use for most small and mid-sized businesses.
In the Microsoft Intune admin center, go to Endpoint security > Disk encryption > Create Policy.
Choose platform macOS and profile macOS FileVault.
Configure the settings in the table below.
Assign to a pilot group of corporate Macs, then to all corporate Macs.
Setting
Recommended value
Purpose
Enable
On
Turns on FileVault
Use Recovery Key
Enabled
Creates a personal recovery key that Intune escrows
Recovery Key Rotation In Months
6 to 12
Regularly replaces the recovery key
Location (escrow description)
Short instructions for retrieving the key
Shown to the user on the recovery screen
Allow deferral until sign out
Enabled
Prompts at sign-out instead of interrupting work
Defer Force At User Login Max Bypass Attempts
0 to 2
Limits how many times a user can skip encryption
The bypass setting is where enforcement lives. If you leave it at “no limit”, users are prompted forever and some will never encrypt. A small number of bypasses, or zero, means FileVault is required at the next sign-in.
Option 2: Settings catalog and Setup Assistant enforcement
The settings catalog exposes the full set of FileVault options under the Full Disk Encryption category. Create it at Devices > macOS > Manage devices > Configuration > Create > New policy and choose Settings catalog. The core settings mirror the endpoint security policy, and Defer must be enabled for FileVault to apply successfully.
The settings catalog also supports enabling FileVault during Setup Assistant on macOS 14 and later. That means a brand-new Mac is encrypted before the user reaches the desktop, which is ideal for new hires. It requires:
Automated device enrollment through Apple Business Manager.
Await final configuration set to Yes in the enrollment profile.
An assignment filter based on the enrollment profile name, so the policy targets those devices during setup.
Do not deploy both an endpoint security FileVault policy and a settings catalog FileVault policy to the same Mac. Pick one approach per device group to avoid conflicts.
Recovery key escrow, retrieval and rotation
Intune escrows the personal recovery key when its policy encrypts the Mac. Users who encrypted their Mac manually before enrollment can be prompted to upload their key so Intune holds a copy.
Where users find their key
Write your escrow location message so a stressed user can follow it without calling IT. For example: “Sign in to the Company Portal website from another device, open Devices, select this Mac and choose Get recovery key.” Users can retrieve keys from:
The Company Portal website, which is the most reliable method.
The Company Portal app on iOS or Android, or the Intune app.
Where admins find it
For corporate Macs, go to Devices > All devices > [device] > Recovery keys and select Show Recovery Key. The encryption report at Devices > Monitor > Encryption report shows FileVault status across all Macs.
Rotation
Automatic rotation replaces the key on the interval you set. After a key has been shared with someone, rotate it manually: open the device in Intune and choose Rotate FileVault recovery key. Manual rotation is available for corporate devices.
The user experience
FileVault rollouts generate questions, not usually problems. A short message before you enforce prevents most of them:
Tell users that the next time they sign out, macOS will ask them to turn on FileVault, and that they should accept.
Explain that encryption runs in the background and the Mac is usable during it.
Tell them where to find the recovery key if they ever need it.
Remind them that the recovery key is a secret. IT will never ask for it by email.
Tie it to compliance
Add Require encryption of data storage on device to your macOS compliance policy. Macs that have not enabled FileVault show as noncompliant, and with a Conditional Access policy requiring a compliant device, they cannot reach Microsoft 365 until encryption is on. Give a short grace period so users have time to sign out and accept the prompt.
Frequently asked questions
Can Intune force FileVault on a Mac?
Yes. Set the maximum bypass attempts low (or zero) so users must enable FileVault at their next sign-in, and use Setup Assistant enforcement on macOS 14 or later for new Macs enrolled through Apple Business Manager.
Can admins see FileVault recovery keys for personal Macs?
No. Intune only lets admins view escrowed FileVault recovery keys for Macs marked as Corporate. Users can still retrieve keys for their own enrolled Macs through the Company Portal.
What happens to the old key after rotation?
Once rotation succeeds, the new key is escrowed in Intune and the previous key no longer unlocks the Mac. Users should retrieve the current key from the Company Portal website when they need it.
Macs are no longer the exception in most offices. Designers, executives and developers often carry them, and they hold the same client data as any Windows laptop. Enforcing FileVault with Intune gives you the same protection you expect from BitLocker: full disk encryption on every company Mac, a recovery key escrowed in Intune, and a self-service way for users to get back in when they forget their password.
This guide covers the prerequisites, the two ways to deploy FileVault from Intune, how key escrow and rotation work, and the user experience details that decide whether your rollout is smooth or noisy.
Prerequisites
Option 1: Endpoint security disk encryption policy
This is the simplest route and the one I use for most small and mid-sized businesses.
Endpoint security > Disk encryption > Create Policy.The bypass setting is where enforcement lives. If you leave it at “no limit”, users are prompted forever and some will never encrypt. A small number of bypasses, or zero, means FileVault is required at the next sign-in.
Option 2: Settings catalog and Setup Assistant enforcement
The settings catalog exposes the full set of FileVault options under the Full Disk Encryption category. Create it at
Devices > macOS > Manage devices > Configuration > Create > New policyand choose Settings catalog. The core settings mirror the endpoint security policy, and Defer must be enabled for FileVault to apply successfully.The settings catalog also supports enabling FileVault during Setup Assistant on macOS 14 and later. That means a brand-new Mac is encrypted before the user reaches the desktop, which is ideal for new hires. It requires:
Do not deploy both an endpoint security FileVault policy and a settings catalog FileVault policy to the same Mac. Pick one approach per device group to avoid conflicts.
Recovery key escrow, retrieval and rotation
Intune escrows the personal recovery key when its policy encrypts the Mac. Users who encrypted their Mac manually before enrollment can be prompted to upload their key so Intune holds a copy.
Where users find their key
Write your escrow location message so a stressed user can follow it without calling IT. For example: “Sign in to the Company Portal website from another device, open Devices, select this Mac and choose Get recovery key.” Users can retrieve keys from:
Where admins find it
For corporate Macs, go to
Devices > All devices > [device] > Recovery keysand select Show Recovery Key. The encryption report atDevices > Monitor > Encryption reportshows FileVault status across all Macs.Rotation
Automatic rotation replaces the key on the interval you set. After a key has been shared with someone, rotate it manually: open the device in Intune and choose Rotate FileVault recovery key. Manual rotation is available for corporate devices.
The user experience
FileVault rollouts generate questions, not usually problems. A short message before you enforce prevents most of them:
Tie it to compliance
Add Require encryption of data storage on device to your macOS compliance policy. Macs that have not enabled FileVault show as noncompliant, and with a Conditional Access policy requiring a compliant device, they cannot reach Microsoft 365 until encryption is on. Give a short grace period so users have time to sign out and accept the prompt.
Frequently asked questions
Can Intune force FileVault on a Mac?
Yes. Set the maximum bypass attempts low (or zero) so users must enable FileVault at their next sign-in, and use Setup Assistant enforcement on macOS 14 or later for new Macs enrolled through Apple Business Manager.
Can admins see FileVault recovery keys for personal Macs?
No. Intune only lets admins view escrowed FileVault recovery keys for Macs marked as Corporate. Users can still retrieve keys for their own enrolled Macs through the Company Portal.
What happens to the old key after rotation?
Once rotation succeeds, the new key is escrowed in Intune and the previous key no longer unlocks the Mac. Users should retrieve the current key from the Company Portal website when they need it.
FileVault is part of our Intune for macOS service. For company-wide device protection, see the endpoint security baseline, and our Intune managed service keeps an eye on encryption status for you. Microsoft’s reference is Encrypt macOS devices with FileVault using Intune.
Not sure every Mac in your business is encrypted? Book a free Microsoft 365 security assessment and we will check your Intune macOS setup.