What this check looks at
Checks that every managed Windows, macOS and Android device reports its disk as encrypted (BitLocker, FileVault or device encryption).
Disk encryption (BitLocker on Windows, FileVault on macOS, device encryption on Android) makes the data on a device unreadable without the user’s sign-in or the recovery key. iPhones and iPads are always encrypted. Windows PCs and Macs are not necessarily: BitLocker is switched on automatically only on some hardware and editions, and FileVault is the user’s choice unless an MDM requires it. Intune reports each managed device’s encryption state.
This check looks at managed Windows, macOS and Android devices that report an encryption state to Intune. The check fails when 10 per cent or more of them are not encrypted, and warns when some are unencrypted but fewer than 10 per cent. The evidence lists the unencrypted devices with operating system and model.
An unencrypted laptop hands everything on it to whoever takes it: cached email (Outlook keeps an offline copy), synced OneDrive and SharePoint libraries, browser passwords and session cookies that can sign in to Microsoft 365. Taking the disk out and reading it on another computer takes minutes and bypasses the Windows password entirely.
Why it matters
A lost or stolen laptop without disk encryption hands over everything on it, including cached email and files, and is usually a reportable personal data breach. With encryption it is the price of a laptop.
A recruitment consultant’s unencrypted laptop is stolen from a car. Its synced OneDrive holds hundreds of candidates’ CVs, passport scans and right-to-work documents. Because the data was readable, the firm must treat it as a personal data breach, assess the risk to every candidate, report to the ICO within 72 hours and write to the people affected. With BitLocker on, the same theft is the cost of a laptop.
Encryption is one Intune policy, runs silently on most devices, and stores the recovery key centrally, so IT can unlock a device after a hardware change or a forgotten PIN.
CIS Controls v8 safeguards 3.6 (encrypt data on end-user devices) and 3.11 (encrypt sensitive data at rest), ISO 27001 A.8.24 (use of cryptography) and A.8.1, the NCSC 10 Steps data security guidance and the NCSC CAF stored data and mobile data outcomes all expect device encryption. NIST CSF PR.DS-01 covers data at rest.
How to fix it
Where: Intune admin centre → Endpoint security → Disk encryption
Before you start
- Check which devices lack encryption and why (unsupported hardware, pending restart, missing TPM).
- Make sure recovery keys will be escrowed to Entra ID or Intune before enforcing.
Step by step
- Find out why each device is unencrypted. In the Microsoft Intune admin centre, open Devices > Monitor > Encryption report. It shows each device’s encryption readiness and status, with the reason where a device cannot encrypt (no TPM, TPM not ready, unsupported edition, waiting for a restart). Compare it with the devices in the evidence.
- Create the BitLocker policy for Windows. Go to Endpoint security > Disk encryption > Create Policy, Platform: Windows, Profile: BitLocker. Set Require Device Encryption to Enabled, Allow Warning For Other Disk Encryption to Disabled (so encryption runs silently) and Allow Standard User Encryption to Enabled. For operating system drives, enforce the encryption type and require recovery information to be backed up to Microsoft Entra ID before BitLocker is turned on. Assign it to your Windows devices.
- Create the FileVault policy for macOS. Create Policy, Platform: macOS, Profile: FileVault. Turn FileVault on, use a personal recovery key escrowed to Intune, and allow only a small number of deferrals at sign-out. FileVault turns on at the user’s next sign-out or restart. Assign it to your Macs.
- Require encryption in the compliance policies. In Devices > Compliance > Policies, edit the Windows, macOS and Android policies and set encryption of data storage on device to Require (and Require BitLocker under Device Health on Windows). Unencrypted devices then show as not compliant and, with a compliant-device Conditional Access policy, lose access until fixed.
- Deal with devices that cannot encrypt. Windows Home cannot be managed with BitLocker policies: upgrade those devices to Windows Pro or replace them. Devices with no TPM, or a TPM switched off in the firmware, need it enabled in the BIOS or UEFI settings. Devices waiting for a restart just need restarting.
- Check the recovery keys are stored. For a sample of devices, open Intune > Devices > the device > Recovery keys (Windows) or Personal recovery key (macOS), and Entra ID > Devices > the device > BitLocker keys, and confirm a key is stored.
- Confirm the devices report encryption. Reopen Devices > Monitor > Encryption report: the listed devices should show Encrypted. The finding clears at the next assessment once every managed Windows, macOS and Android device reports encryption.
What users will notice
Devices encrypt in the background; some need a restart. Users are not usually asked anything.
How to confirm it worked
Intune, Devices, Monitor, Encryption report: listed devices show "Encrypted" with a recovery key stored.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.c Stored dataB3.d Mobile data |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(h) Cryptography and encryption |
| Microsoft Cloud Security Benchmark | DP-4 Enable data at rest encryption by default |
| Zero Trust | EndpointsData |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architecturesCC6.7 Restricting the transmission, movement and removal of information |
| NIST SP 800-171 | 3.13.16 Protect the confidentiality of CUI at rest |
| CMMC Level 2 | SC.L2-3.13.16 Data at Rest |
| ISO 27001:2022 | A.8.24 Use of cryptographyA.8.1 User endpoint devices |
| CIS Controls v8.1 | 3.6 Encrypt data on end-user devices (IG1)3.11 Encrypt sensitive data at rest (IG2) |
| NIST CSF 2.0 | PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Disk encryption policy in Intune (Microsoft Learn)