How to Configure BitLocker on Intune for SMBs: A Step-by-Step Guide

BitLocker drive encryption is an essential security feature for any business, especially small and medium-sized businesses (SMBs) looking to protect sensitive data on their Windows devices. When combined with Microsoft Intune, deploying and managing BitLocker across your organization becomes streamlined and efficient. This detailed guide will walk SMB IT administrators through the process of configuring BitLocker on Intune, ensuring your data is encrypted and secure.

Key Takeaways

• BitLocker encrypts whole volumes, protecting data if a device is lost or stolen.
• Requires Windows Pro, Enterprise or Education. Home editions cannot run it.
• Store recovery keys in Entra ID so IT can retrieve them.
• Use XTS-AES 256-bit for operating system and fixed data drives.
• Pilot on a small device group before enforcing across the fleet.

Why BitLocker and Intune are Critical for SMBs

Data breaches can be devastating for SMBs, leading to financial losses, reputational damage, and regulatory penalties. BitLocker provides a robust defense by encrypting entire volumes, making data unreadable to unauthorized users even if a device is lost or stolen. Intune, as a cloud-based unified endpoint management (UEM) solution, allows you to remotely deploy, manage, and monitor security policies like BitLocker across all your Windows devices, regardless of their location. This combination is crucial for maintaining compliance, enhancing data protection, and simplifying IT administration for SMBs.

Prerequisites for Configuring BitLocker with Intune

Before you begin, ensure you meet the following prerequisites:

• Microsoft Intune Subscription: Your organization must have an active Microsoft Intune subscription (e.g., Microsoft 365 Business Premium, Enterprise Mobility + Security E3/E5).
• Windows 10/11 Pro, Enterprise, or Education: BitLocker is available on these editions of Windows. Home editions do not support BitLocker.
• Azure Active Directory (Azure AD) Joined or Hybrid Azure AD Joined Devices: Devices must be enrolled in Intune via Azure AD Join or Hybrid Azure AD Join.
• TPM (Trusted Platform Module) 1.2 or higher: While not strictly required for software encryption, a TPM greatly enhances BitLocker security by protecting encryption keys.
• Administrative Rights: You need Global Administrator or Intune Administrator roles in Azure AD to configure these policies.

Step-by-Step Guide to Configure BitLocker on Intune

Follow these steps to set up and deploy BitLocker encryption using Microsoft Intune.

Step 1: Access the Microsoft Intune Admin Centre

1. Open your web browser and navigate to the Microsoft Intune Admin Centre.
2. Sign in with your administrative credentials.

Step 2: Create a Device Configuration Profile

1. In the Intune Admin Centre, navigate to Devices > Configuration profiles.
2. Click Create profile.
3. For Platform, select Windows 10 and later.
4. For Profile type, select Templates, then choose Endpoint protection.
5. Click Create.

Step 3: Configure Basic Profile Settings

1. Basics:
   • Name: Enter a descriptive name for your profile, e.g., "BitLocker Policy for Windows Devices".
   • Description: (Optional) Provide a brief description, e.g., "Enforces BitLocker encryption on Windows 10/11 Pro/Enterprise devices."
2. Click Next.

Step 4: Configure BitLocker Settings

This is the most critical step where you define how BitLocker will behave on your devices.

1. Under Configuration settings, expand the Windows Encryption (BitLocker) section.
2. Configure the following key settings:
   • Encrypt devices: Set to Require. This is essential to ensure devices are encrypted.
   • Warning for other disk encryption: Set to Block. This prevents users from using other encryption methods.
   • Allow standard users to enable encryption: Set to Not configured or Block. Typically, you want administrators to manage encryption.
   • Configure encryption methods:
     • Require device encryption: Set to Require.
     • Select drive encryption method for operating system drives: Choose XTS-AES 256-bit (recommended for stronger security).
     • Select drive encryption method for fixed data drives: Choose XTS-AES 256-bit.
     • Select drive encryption method for removable data drives: Choose XTS-AES 256-bit.
   • BitLocker recovery: This section is crucial for recovery scenarios. Configure as follows:
     • Store BitLocker recovery information in Azure Active Directory: Set to Require. This stores recovery keys in Azure AD for easy retrieval by IT administrators.
     • Encrypt recovery information in Azure Active Directory: Set to Require.
     • BitLocker recovery key package: Set to Password and key package.
     • Require Device Encryption: Set to Require.
   • Fixed data-drive recovery:
     • Fixed data-drive recovery: Set to Require.
     • Select how fixed data-drives are recovered: Choose Allow data recovery agent and Microsoft-hosted recovery service.
     • Configure BitLocker To Go recovery support: Set to Require.
   • Operating system drive settings:
     • Startup authentication requirement: Set to Require.
     • Compatible TPM startup: Set to Require TPM.
     • Compatible TPM startup PIN: Set to Require PIN with TPM (if you want an extra layer of pre-boot authentication).
     • Compatible TPM startup key: Set to Block (unless you have a specific use case).
     • Compatible TPM startup key and PIN: Set to Block.
     • Disable BitLocker on the operating system drive: Set to Not configured or Block.
   • Fixed data drives:
     • Fixed data drives: Set to Require.
     • Require BitLocker on fixed data drives: Set to Require.
     • Hide prompt at BitLocker wizard for fixed data drives: Set to Hide only.
     • Allow write access to fixed data drives not protected by BitLocker: Set to Block.
   • Removable data drives:
     • Removable data drives: Set to Require.
     • Require BitLocker on removable data drives: Set to Require.
     • Allow write access to removable data drives not protected by BitLocker: Set to Block.
     • Allow users to suspend and resume BitLocker protection for removable data drives: Set to Not configured or Block.
3. Click Next.

Step 5: Assign the Profile to Groups

1. Under Assignments, click Add groups.
2. Select the Azure AD security groups that contain the Windows devices or users you want to target with this BitLocker policy. It's best practice to target device groups for BitLocker policies.
3. You can also use Exclude groups if there are specific devices or users you don't want this policy to apply to.
4. Click Next.

Step 6: Review and Create the Profile

1. Review all your configured settings under Review + create.
2. If everything looks correct, click Create.

The policy will now be deployed to your targeted devices. Devices will receive the policy during their next Intune sync cycle. BitLocker encryption will then begin automatically in the background, prompting users if user interaction is required (e.g., for PIN setup) or silently encrypting if the device supports silent encryption.

Monitoring BitLocker Encryption Status

After deploying the policy, it's crucial to monitor the encryption status of your devices.

1. In the Intune Admin Centre, navigate to Devices > Monitor.
2. Select Encryption report. Here you can see the encryption status for all your enrolled devices, including their BitLocker recovery keys, which are stored in Azure AD.

Retrieving BitLocker Recovery Keys

In case a user forgets their PIN or password, or a device needs recovery:

1. Go to Devices > All devices.
2. Select the device in question.
3. Under the Monitor section of the device overview, click on Recovery keys.
4. The BitLocker recovery key will be displayed, which can be provided to the user for device access.

Practical Tips for SMB IT Admins

• Pilot Deployment: Always deploy BitLocker policies to a small pilot group of devices before rolling it out to your entire organization. This allows you to identify and resolve any issues without affecting your entire workforce.
• User Communication: Inform your users about the upcoming BitLocker deployment. Explain what BitLocker is, why it's important, and what they might experience (e.g., potential prompts for PINs or a slight performance impact during initial encryption).
• Recovery Key Management: Emphasize the importance of not sharing recovery keys. Assure users that keys are safely stored in Azure AD and can be retrieved by IT when needed.
• Performance Impact: Initial encryption can be resource-intensive. Schedule deployments during off-hours or inform users that their device might experience a temporary slowdown. Modern devices with SSDs and newer processors will often encrypt silently with minimal user impact.
• Policy Refinement: Regularly review and refine your BitLocker policies as your organizational needs and security landscape evolve. Ensure your encryption methods are up to date.
• Troubleshooting: If devices aren't encrypting, check the following:
  • Device compliance status in Intune.
  • Event logs on the client device for BitLocker-related errors.
  • Ensure the device meets all prerequisites (TPM, Windows edition).

FAQ

Does BitLocker slow a computer down?

Modern devices with SSDs and hardware AES support show little day-to-day impact. The initial encryption pass is resource-intensive, so schedule it outside business hours or warn users to expect a temporary slowdown on the first day.

What happens if a user forgets their BitLocker PIN?

You retrieve the recovery key from the device record in Intune under Recovery keys and provide it to the user. This only works if your policy stored recovery information in Entra ID, which is why that setting is set to Require.

Can we use BitLocker on Windows Home editions?

No. BitLocker requires Windows Pro, Enterprise or Education. Devices on Home need an edition upgrade before they can be encrypted, which is worth checking before you buy hardware rather than after.

Is a TPM chip required?

Not strictly, since software-based encryption is possible, but a TPM protects the encryption keys in hardware and enables silent encryption without user prompts. Any business machine bought in the last several years will have one.

Why are devices not encrypting after the policy deploys?

Check three things in order: the device's compliance and sync status in Intune, the Windows edition, and the BitLocker event logs on the client. Most failures come from an unsupported edition or a device that simply has not synced yet.

Configuring BitLocker on Intune provides SMBs with a powerful and efficient way to enforce disk encryption across their Windows device fleet. By following this step-by-step guide, you can significantly enhance your organization's data security posture, meet compliance requirements, and simplify the management of your endpoint security. Proactive data protection is now a baseline expectation for any business holding client information, and BitLocker with Intune delivers it without adding another product to manage.