Encrypting a laptop is the easy part. The part that bites people is the morning a machine will not boot, or a user forgets their PIN, and the recovery key is nowhere to be found. Done properly with Intune, every Windows device encrypts itself silently and the recovery key lands somewhere you can always get it. Here is how, and the gotchas that leave a device half done.
Why encryption without escrow is a trap
BitLocker without a recovery key stored somewhere safe is worse than no BitLocker, because now you have a locked device and no way in. The recovery key is the whole point. The goal is not just "encrypted", it is "encrypted, and I can prove the recovery key is in a place only the right people can reach". With Intune that place is the device object in Microsoft Entra ID, and the encryption and the escrow happen in the same policy, so there is no window where a device is locked without its key saved.
The policy that encrypts and escrows in one go
In the Intune admin centre, go to Endpoint security, Disk encryption, and create a BitLocker policy for Windows. The settings that matter:
- Require encryption of the operating system drive, and of fixed data drives if you have them.
- Encryption method XTS-AES 256 for modern hardware, or 128 if you still run older machines.
- Enable silently, so the user is never prompted and never has to do anything. For this to work the device needs a TPM, which almost every business laptop from the last several years has.
- Save BitLocker recovery information to Microsoft Entra ID, and set it to store that information before enabling encryption. This is the line that closes the gap: the device will not finish encrypting until the key is safely escrowed.
- Turn on client driven recovery password rotation, so a key that has been used once is replaced automatically.
Assign it to your Windows devices. New devices encrypt during Autopilot, existing ones at the next policy sync.
Check it actually took
Do not assume. In Intune, under the device, or in the encryption report under Monitor, you can see the encryption status of every machine: encrypted, not encrypted, or in progress, and whether the recovery key was escrowed. On a healthy fleet this is where your "100 percent of laptops encrypted, every recovery key escrowed" number comes from, and it is exactly the line a cyber insurer or a client questionnaire asks for. You can also open any device in Entra and see its recovery key listed against it, which proves the escrow rather than just trusting the policy.
The gotchas that leave a device half done
Most "it says encrypted but there is no key" problems come from one of these.
- Devices encrypted before the policy. A machine someone turned BitLocker on manually, before Intune managed it, may be encrypted with a key that was never escrowed to Entra. The policy does not always back fill it. Find these in the report and rotate or re-escrow the key so it is captured.
- No usable TPM. Silent enablement needs a TPM that is present and ready. An older device, or one where the TPM is turned off in firmware or sitting in a pending state, will not encrypt silently. Turn the TPM on in firmware, or handle those few devices by hand.
- Only the OS drive covered. If people keep data on a second fixed drive, make sure the policy covers fixed data drives too, not just the operating system drive.
- Assuming in progress means done. Encryption takes time on a large drive. A device can sit at in progress for a while. Check the report a day later, not a minute later.
Get this right and encryption stops being a thing you hope is on and becomes a number you can show, with every recovery key one click away. It is part of what we set up in a Hardening project and then watch every month under Managed Intune.