Best Practices for Implementing BitLocker Policy in Your Organization

To set up BitLocker policy using configuration profiles in Intune, follow these steps:

Prerequisites:

• Ensure you have the necessary Intune licenses.

• Enrolled Windows 10 or 11 devices that support BitLocker.

• Azure AD joined or Hybrid Azure AD joined devices.

• Administrative rights on the Intune portal.

  
  

Step-by-Step Guide:

1. Sign into the Intune Portal

• Go to the Microsoft Endpoint Manager admin center.

  
  

2. Create a Device Configuration Profile

• Navigate to Devices > Configuration.

• Click + "+ Create > +New Policy".

3. Configure the Profile

• Platform: Select Windows 10 and later.

• Profile type: Templates and Select Endpoint protection.

4. Configure BitLocker Settings

• In the Configuration settings section, expand Windows Encryption.

• Configure the following settings according to your organization's requirements:

  • Require BitLocker: Set to Yes.

  • Encryption for operating system drives: Configure settings such as XTS-AES 128-bit encryption.

  • Encryption for fixed data drives: Configure settings such as XTS-AES 128-bit encryption.

  • Encryption for removable data drives: Configure settings such as AES-CBC 128-bit encryption.

  • BitLocker base settings: Configure additional settings like BitLocker recovery information to Azure AD, require device to back up recovery information, etc.

5. Configure BitLocker Recovery Settings

• In the BitLocker Recovery section: configure as shown in the below screenshot.

6. Configure BitLocker Fixed Drive Settings

• In the Fixed Data Drives section, configure as shown in the below screenshot.

7. Configure BitLocker Removable Drive Settings

• In the Removable Data Drives section, configure settings related to the encryption of removable data drives.

8. Assign the Profile to Device Groups

• In the Assignments tab, select the groups of devices you want to assign the BitLocker policy to.

9. Review and Create the Profile

• Review all the configured settings.

• Click Create to create the configuration profile.

  
  

10. Monitor and Troubleshoot

• After assigning the profile, monitor the deployment status by navigating to Devices > Configuration profiles.

• Select the profile and check the Device status and User status tabs to ensure successful application.