3.2MD-102Intermediate
Est: ~15 mins•Verified: 2026-08
BitLocker Silent Disk Encryption & Key Escrow
Deploy silent background BitLocker drive encryption without end-user interaction, enforce TPM 2.0, and escrow recovery keys into Microsoft Entra ID.
Tags:#BitLocker#Disk Encryption#TPM 2.0#Recovery Keys#Endpoint Security#MD-102
01
Overview
Full disk encryption using BitLocker is the enterprise standard for safeguarding corporate data on mobile Windows laptops against physical theft and offline extraction attacks.
Using Microsoft Intune, administrators can configure Silent Encryption, encrypting the primary drive in the background without user prompts, while automatically escrowing the 48-digit Recovery Key directly into the device's record in Microsoft Entra ID.
---
02
When to Use
| Scenario | Recommendation | Technical Rationale |
|---|---|---|
| All Corporate Laptops | Mandatory | Protects data at rest if a laptop is lost, stolen, or improperly decommissioned. |
| Self-Service Key Recovery | Enabled | Users can independently retrieve their BitLocker recovery keys from myaccount.microsoft.com. |
---
04
Portal Path
TEXT
Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Endpoint security
└── Disk encryption
└── Create Policy
├── Platform: Windows 10 and later
└── Profile: BitLocker---
05
Step-by-Step Implementation
Key Settings for Silent BitLocker:
- Enable full disk encryption for OS and fixed data drives:
Yes - Hide prompt about third-party encryption:
Yes - Allow standard users to enable encryption during Autopilot:
Yes(Crucial: allows non-admins to trigger encryption) - Encryption Methods:
- Operating system drives:
XTS-AES 256-bit
- BitLocker OS Drive Settings:
- Compatible TPM startup:
Require TPM - Compatible TPM startup PIN:
Do not allow(Ensures silent operation without pre-boot PIN prompts)
- Save BitLocker recovery information to Azure Active Directory:
Required
---
06
PowerShell Commands
Query BitLocker Status Locally:
PowerShell
# Check volume status and protection state
manage-bde -status C:
# Query via PowerShell cmdlet
Get-BitLockerVolume -MountPoint "C:" | Format-ListTrigger Manual BitLocker Encryption & Key Backup:
PowerShell
# Enable BitLocker with TPM protector and backup to Entra ID
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector
BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId (Get-BitLockerVolume -MountPoint "C:").KeyProtector[1].KeyProtectorId---
10
Troubleshooting Matrix
| Error Code | Root Cause | Resolution |
|---|---|---|
| 0x80072f9a (Key Backup Failure) | The device cannot communicate with Entra ID to escrow the recovery key. | BitLocker will not encrypt if "Save recovery information to Azure AD" is set to Required and the backup fails. Check network connectivity. |
| Error 65000 (TPM Not Ready) | TPM 2.0 is disabled in BIOS or not provisioned in Windows. | Launch tpm.msc and verify "The TPM is ready for use". |
---
12
MD-102 Exam Notes
Exam Blueprint & High-Yield Traps
Key Exam Traps:
- By default, standard users cannot enable BitLocker in Windows. In Intune, you MUST set Allow standard users to enable encryption during Azure AD Join to
Yes. - BitLocker recovery keys can be retrieved from:
- Intune Admin Center > Devices > Windows > Select device > Recovery keys.
- Microsoft Entra Admin Center > Devices > All devices > Select device > BitLocker keys.