Question

Your organization deploys corporate Windows 11 devices via Autopilot with Entra join. Security requires that the operating system drive be encrypted with BitLocker automatically during provisioning, with no interaction or prompts shown to end users, and recovery keys must be escrowed to Entra ID. All devices have a TPM 2.0 chip. Which combination of settings in the Intune disk encryption (endpoint security) policy achieves silent BitLocker enablement?

Accepted Answer

Set 'Warning for other disk encryption' to Block, 'Allow standard users to enable encryption during Autopilot' to Yes, and require compatible TPM startup, and configure OS drive recovery to save keys to Entra ID before enabling encryption.

Answer

Configure a startup PIN as required and set the encryption method to XTS-AES 256-bit so users authenticate at boot.

Answer

Enable 'Hide prompt about third-party encryption' set to No and require a startup key on a USB drive for each device.

Answer

Deploy a compliance policy that marks devices non-compliant unless BitLocker is on, and let users manually turn on encryption from Settings.