When we think about encryption for a Microsoft-based network, what generally first springs to mind is BitLocker, Microsoft’s native fixed-drive encryption software. But that highlights a tendency to forget that in a network there are many locations where encryption decisions are made.
These decisions are important but not always obvious, especially when they’re made by application or software vendors that recommend certain settings during the software installation process. I can’t tell you how many times a vendor has recommended settings that have given me pause and even made me question their stance on security.
Modern businesses manage many types of encryption across their sometimes vast networks. I’d argue that, on balance, cybersecurity teams do a decent job managing encryption on mobile workstations. It’s relatively straightforward to enable BitLocker with a PIN during Autopilot deployment — in Autopilot configuration, a template can be set in Intune’s endpoint protection. In addition, with Windows 11 machines that meet certain hardware configurations, such as devices that meet modern standby or meet the Hardware Security Testability Specification (HSTI), encryption happens by default during the out-of-box experience and encryption keys are backed up either to a Microsoft account or an Entra ID account by default.
Additional options can strengthen BitLocker encryption
If the user needs a recovery key, should it be necessary to reset a workstation back to default settings, or should a device ask for a BitLocker key during patching, the recovery key will be stored in a location that the help desk can refer them to. Autopilot allows the configuration of additional options, such as strengthening the Bitlocker encryption algorithm. On the Bitlocker CSP in Intune, you can specify a stronger algorithm such as XTS-AES 256-bit. You can configure this in Endpoint Security > Disk Encryption > Create Policy > Platform > Windows 10 and later and then choose the BitLocker profile type.
Ultimately, companies will want to measure compliance with policy — to review device encryption status across a firm and options for monitoring and reporting. In a given domain, there may be scripting or third-party management tools that may be used to identify those drives that are encrypted. Where there is Intune licensing, reports can be pulled using the Intune encryption status report console.
Log in to the Intune portal, then go to Devices, then Monitor and click on the encryption report. From there you’ll get a status report of computers, what TPM version they have, if they are ready for encryption and most importantly, if they are encrypted. It will also identify who has the username assigned to that computer device name so you can identify the “owner” of the computer.
