BitLocker is a Windows full-disk encryption feature that protects device data at rest.
Mobile Guardian supports two methods for deploying BitLocker policy to enrolled Windows devices: a dashboard-based approach using Windows MDM Settings, and a custom OMA-URI approach for admins who need granular control over specific enforcement settings. Both methods push configuration through Microsoft Intune to enrolled devices.
What You Will Learn
- How BitLocker encryption maps to Profiles in Mobile Guardian
- How to configure BitLocker using the dashboard (Windows MDM Settings)
- How to configure BitLocker using custom OMA-URI entries in Intune
- How to verify encryption status on enrolled devices
Prerequisites
- Windows 10/11 Pro or higher (BitLocker is not available on Windows Home editions)
- Devices enrolled in Mobile Guardian via Microsoft Intune (see Windows OS Onboarding: Part 1)
- Admin access to the Mobile Guardian Dashboard
- Admin access to Microsoft Intune
How BitLocker Fits Into Mobile Guardian Profiles
BitLocker configuration in Mobile Guardian is applied at the profile level, not per-device. Encryption policy is defined once in a profile and pushed to all devices assigned to that profile.
Recommended profile structure for BitLocker:
| Profile Type | Use Case |
|---|---|
| Baseline Profile | Apply a standard encryption policy to all enrolled Windows devices as a default safety net |
| Conditional Profile | Apply stricter or device-specific encryption requirements to a defined group (e.g., staff devices, lab devices) based on tags or device ownership |
Note: All devices will have a baseline profile applied. Use a conditional profile when you need encryption settings that differ from the school-wide default — for example, enforcing TPM + PIN for staff devices while using TPM-only for student devices.
Method 1: Dashboard-Based Configuration (Windows MDM Settings)
This method uses the built-in Windows MDM settings in the Mobile Guardian dashboard. It is the recommended starting point for most schools.
Step 1: Access Windows MDM Settings
- Navigate to Settings in the left-hand menu
- Select Windows MDM Settings
Note: Windows MDM Settings are global and apply to all Windows devices enrolled in your school account. Profile-level overrides are configured within the Profiles section.
Step 2: Enable BitLocker
Under the Encryption section:
- Locate BitLocker Drive Encryption
- Toggle Enable BitLocker to On
Step 3: Configure Encryption Options
Configure the following settings based on your school's requirements:
Operating System Drive
- Require device encryption: Set to Enabled
- Encryption method: Select XTS-AES 128-bit (recommended) or XTS-AES 256-bit for higher security
- Startup authentication: Choose the authentication method required at boot:
- TPM only — Device unlocks automatically using the Trusted Platform Module chip (recommended for student devices)
- TPM + PIN — Requires the user to enter a PIN at startup (recommended for staff or high-security devices)
- TPM + Startup key — Requires a USB key at startup
Fixed Data Drives
- Encrypt fixed data drives: Set to Enabled
- Deny write access to fixed drives not protected by BitLocker: Set to Enabled (recommended)
Removable Data Drives
- Deny write access to removable drives not protected by BitLocker: Set to Enabled or Disabled depending on your USB policy
Note: TPM only is the lowest-friction option for student devices as it does not require any additional action at startup. TPM + PIN is recommended for staff or admin devices that may leave school premises.
Step 4: Configure Recovery Key Storage
- Store BitLocker recovery information in Azure AD: Set to Enabled
- Recovery key storage: Select Recovery password and key package
Important: Ensure recovery keys are being escrowed to Azure AD before enforcing encryption. Without a recovery key, a device that fails to boot cannot be recovered without wiping.
Step 5: Save and Apply
- Click Save Changes at the bottom of the Windows MDM Settings page
- The policy will be pushed to enrolled devices on their next Intune sync (typically within 15 minutes)
Method 2: Custom OMA-URI Configuration (Advanced)
This method uses individual OMA-URI entries in Microsoft Intune's Custom profile type to enforce specific BitLocker settings at the CSP level. It is suited to admins who need precise control over enforcement behaviour, or who are deploying alongside an existing Intune setup.
Note: This method covers enforcement settings only. For full BitLocker policy configuration — encryption method (XTS-AES 128/256), startup authentication (TPM, TPM + PIN), and recovery key escrow — use Intune's Endpoint Security > Disk Encryption profile, which exposes those controls in a guided UI. See Step 2 below.
Step 1: OMA-URI Entries
The following BitLocker CSP nodes can be deployed as individual Custom OMA-URI entries in Intune. Each row is added as a separate entry.
| OMA-URI | Data Type | Value | Purpose |
|---|---|---|---|
| ./Device/Vendor/MSFT/BitLocker/RequireDeviceEncryption | Integer | 1 | Enforce BitLocker encryption on the device |
| ./Device/Vendor/MSFT/BitLocker/AllowWarningForOtherDiskEncryption | Integer | 0 | Suppress user prompt; enables silent encryption deployment |
| ./Device/Vendor/MSFT/BitLocker/AllowStandardUserEncryption | Integer | 1 | Allow encryption to trigger without local admin rights on the device |
Note: AllowStandardUserEncryption only takes effect when AllowWarningForOtherDiskEncryption is set to 0. Both must be deployed together for silent standard-user encryption to work.
Step 2: Configure Full Policy Settings via Endpoint Security
For encryption method, startup authentication, and recovery key options, use Intune's built-in BitLocker profile rather than custom OMA-URI entries:
- Sign in to the Microsoft Intune Admin Centre
- Navigate to Endpoint security > Disk encryption > Create Policy
- Platform: Windows 10 and later
- Profile: BitLocker
- Configure encryption method, startup authentication, and recovery key escrow settings as required
- Assign to the relevant group and click Create
Step 3: Deploy Custom OMA-URI Entries via Intune
- Sign in to the Microsoft Intune Admin Centre
- Navigate to Devices > Manage Devices > Configuration > Create > New Policy
- Platform: Windows 10 and later
- Profile type: Custom
- Click Create and enter a descriptive name (e.g. Mobile Guardian BitLocker Enforcement)
- Under OMA-URI Settings, click Add and enter each row from the table in Step 1 as a separate entry
- Assign to the relevant group (e.g. Students or Staff) and click Review + Create
Step 4: Link the Policy Back to Mobile Guardian Profiles
- Navigate to Profiles in the Mobile Guardian left-hand menu
- Select the Baseline Profile (for school-wide enforcement) or the relevant Conditional Profile
- Under the What section of the profile, confirm that Windows device settings are active for the assigned group
- The Intune policy will apply automatically to any device enrolled in the matching Azure AD group
Verifying Encryption Status
Once the policy has been pushed, you can verify encryption status from the Mobile Guardian dashboard, from the device directly, or from Microsoft Intune.
From the Mobile Guardian Dashboard
- Navigate to Devices in the left-hand menu
- Select All Devices and locate the Windows device
- Click the eye icon to open the Device Information view
- Under the Device Details section, check the Encryption Status field
Note: Encryption status may take up to 30 minutes to update in the dashboard after the policy is first applied, depending on drive size and device performance.
From the Device Directly
- Open File Explorer
- Right-click the C: drive
- A padlock icon on the drive indicates BitLocker is active
- Select Manage BitLocker to view encryption status and recovery key details
From Microsoft Intune
- Navigate to Devices > All Devices in the Intune Admin Centre
- Select the device
- Under Monitor, select Encryption report
- Confirm Encryption status shows Encrypted and Key escrow status shows Recovery key backed up
Troubleshooting
| Issue | Likely Cause | Resolution |
|---|---|---|
| Device not encrypting after policy push | TPM not present or not enabled in BIOS | Verify TPM 2.0 is enabled in device firmware settings |
| Encryption status not updating in dashboard | Intune sync delay | Trigger a manual sync: Settings > Accounts > Access Work or School > Info > Sync |
| Recovery key not backed up to Azure AD | Azure AD join not completed before policy applied | Confirm device is Azure AD joined, then re-trigger the policy |
| BitLocker prompt appearing for student | AllowWarningForOtherDiskEncryption not set to 0 | Set this CSP node to 0 to enforce silently |
Please let us know if you found this helpful!
Thanks for reading!