Without disk encryption, a stolen laptop means a data breach — any person can simply remove the hard drive and read all the files. Disk encryption, like BitLocker, scrambles the data so it is unreadable without the correct key, protecting sensitive information even when a device is lost or stolen. For the MD-102 exam, you must understand how to deploy and manage BitLocker policies across an organisation to enforce this protection.
Jump to a section
A simple way to picture Implementing BitLocker and Device Encryption
A bank safety deposit box manager is responsible for securing customers' most valuable possessions in a vault. When a customer rents a box, the manager gives them a unique key. The vault itself has a second, master key held by the bank. To open the box, both keys must be used together — the customer's key and the bank's master key. If the customer loses their key, the manager can use a special recovery process with the master key to open the box, but only after the customer proves their identity.
Implementing BitLocker on a Windows device works exactly like this. BitLocker encrypts the entire hard drive — the safety deposit box — so no one can read the data without the right credentials. The 'customer's key' is the user's password or PIN, and the 'bank's master key' is the recovery key stored in Microsoft Entra ID or Active Directory. If a user forgets their PIN (loses their key), the IT administrator — the safety deposit box manager — can unlock the drive using the recovery key (the master key), but only after verifying the user's identity. This dual-key system ensures that even if someone steals the physical laptop, they cannot access the data without both keys. The manager also ensures that every box has a recovery method configured before the customer leaves, just as an IT professional ensures a BitLocker recovery key is backed up before a device is encrypted.
Implementing BitLocker and device encryption is about locking down the data on your computer's hard drive so that if someone steals the physical machine, they cannot read anything. This is critical for businesses because a lost laptop can contain customer records, financial data, or trade secrets. BitLocker is a feature built into Windows Pro and Enterprise editions that encrypts the entire drive, not just individual files.
Let us break down the core concepts. First, 'encryption' is the process of scrambling data using a mathematical formula called a 'cipher'. The data becomes a meaningless jumble of characters. To turn it back into readable information, you need a 'decryption key' — a long, unique string of numbers and letters. BitLocker uses a cipher called AES (Advanced Encryption Standard) with a 128-bit or 256-bit key length. A 256-bit key means there are 2^256 possible keys — an astronomically large number that makes brute-force guessing impractical.
The 'Trusted Platform Module' (TPM) is a special hardware chip soldered onto the motherboard of modern computers. It is like a secure vault for keys. When you enable BitLocker, the TPM stores the encryption key securely and only releases it if the system has not been tampered with. For example, if someone removes the hard drive and puts it into another computer, the TPM will not unlock it because the hardware environment has changed. This is called 'sealing' the key to the system.
BitLocker can work with or without a TPM. Without a TPM, you must use a password or a USB startup key, but Microsoft does not recommend this because it is less secure. For the MD-102 exam, assume TPM is present.
'Device encryption' is a lighter version of BitLocker that is automatically enabled on many modern Windows devices (like Surface tablets). It encrypts the drive and stores the recovery key in your Microsoft account. Device encryption is enabled by default if the hardware supports 'InstantGo' (a low-power standby mode) and the TPM. It requires the user to sign in with a Microsoft account to make the recovery key available. For managed organisations, BitLocker offers more granular control through Group Policy or Microsoft Intune.
How does IT manage BitLocker across hundreds or thousands of devices? Using policies. A 'BitLocker policy' is a set of rules that tells Windows how to encrypt drives and how to handle recovery keys. You can enforce: which encryption method to use (AES 128-bit or 256-bit), whether the user must enter a PIN on startup, whether to encrypt the entire drive or only used space, and where to save the recovery key (such as Microsoft Entra ID or Active Directory Domain Services).
Recovery is a big part of the exam. The 'recovery key' is a 48-digit numerical password that can unlock the drive if the TPM fails, the user forgets their PIN, or the system experiences a hardware failure. IT professionals must ensure that every device has its recovery key escrowed (stored securely) in a central location, like Microsoft Entra ID or AD, before encrypting. If a user calls the help desk because their BitLocker-protected PC will not boot, the help desk can retrieve the recovery key from the central store and provide it over the phone.
BitLocker also supports 'pre-boot authentication' — requiring a PIN or password before Windows starts. This defends against attacks where someone starts the computer and tries to bypass Windows. The PIN is entered on a blue screen before the operating system loads.
Finally, 'Symmetric vs Asymmetric' encryption: BitLocker uses symmetric key encryption, where the same key encrypts and decrypts the data. The volume master key (VMK) is the symmetric key that encrypts the drive. That VMK itself is encrypted by one or more 'key protectors', such as the TPM, a recovery key, or a PIN. This layered approach means that compromising one element does not break the entire system.
Check TPM Compatibility
Use a PowerShell command (Get-Tpm) or the TPM Management Console to verify that the device has a TPM 2.0 chip and that it is turned on. Without this, BitLocker will require additional configuration.
Create a BitLocker Policy in Intune
Navigate to Endpoint Manager > Endpoint security > Disk encryption. Create a policy that specifies the encryption method (AES 256-bit), requires TPM, and sets recovery key escrow to Microsoft Entra ID.
Assign the Policy to Device Groups
Assign the BitLocker policy to the appropriate group (e.g., 'All Windows Devices'). The policy will apply automatically when devices check in with Intune.
Encrypt the Drive
The policy triggers BitLocker encryption. For new devices, this happens silently during provisioning. For existing devices, the user can continue working while encryption runs in the background.
Escrow the Recovery Key
Ensure the recovery key is automatically stored in Microsoft Entra ID by checking the policy setting. This allows IT to retrieve the key later if needed.
Monitor Compliance
In Intune, use the 'Disk encryption' report to see which devices are compliant, which are pending, and whether recovery keys are backed up. Take action on non-compliant devices.
Handle Recovery Requests
When a user cannot boot, verify their identity, then retrieve the 48-digit recovery password from Microsoft Entra ID. Provide it over the phone so they can unlock the drive.
An IT professional named Sarah works for a mid-sized company with 500 laptops used by sales representatives. The laptops travel everywhere — coffee shops, client offices, airports. The company stores client contracts, pricing data, and employee personal information on these devices. Sarah's first task is to ensure every laptop is encrypted with BitLocker before a new hire receives it.
Here is exactly what Sarah does, step by step:
She verifies that each laptop has a TPM chip version 2.0. She uses a PowerShell command (Get-Tpm) to check. If a device lacks TPM, she replaces it because BitLocker with TPM is the standard security baseline.
Sarah creates a BitLocker policy in Microsoft Intune, which is a cloud-based device management service. The policy specifies:
Encryption method: AES 256-bit.
Require TPM on startup.
Do not allow users to turn off BitLocker.
Escrow recovery keys to Microsoft Entra ID automatically.
Enforce encryption of the operating system drive and fixed data drives (like D:).
She assigns the policy to a group called 'All Company Devices' so that every laptop receives the settings.
When a sales rep named John receives his new laptop and signs in with his work account (Microsoft Entra ID), Intune scans the device and applies the BitLocker policy. The drive begins encrypting in the background. John can keep working while encryption runs — there is no downtime.
Sarah monitors compliance in the Intune console. She sees a dashboard showing how many devices are encrypted, how many are pending, and which devices have their recovery keys backed up.
One day, John calls the help desk because his laptop will not boot. After verifying his identity, Sarah opens the Microsoft Entra admin centre, finds John's device, and retrieves the 48-digit BitLocker recovery key. She reads it to John over the phone, and he enters it to unlock the drive. The computer boots normally.
For a security audit, Sarah needs to prove that all company data is encrypted. She exports a compliance report from Intune showing that 100% of devices are encrypted. This report satisfies the auditor.
When a laptop is retired or reassigned, Sarah uses the 'Clear TPM' option in Intune to rotate the keys, ensuring that the old keys cannot be used on the new device.
The lesson: IT professionals do not manually encrypt each computer. They use policies and tools like Intune or SCCM (System Center Configuration Manager) to automate the process. The most common real-world challenge is users calling for recovery keys because they forgot their PIN or the TPM malfunctioned. The second challenge is ensuring that old laptops are properly decrypted and wiped before disposal — otherwise, encryption keys still exist and data might be recoverable.
The MD-102 exam tests your ability to configure, manage, and troubleshoot BitLocker in an enterprise environment. Expect questions that present real-world scenarios and ask you to choose the correct policy setting or troubleshooting step. Here is what you must know:
'TPM 2.0' is the expected standard. The exam loves asking what happens if TPM is missing: answer — you can still enable BitLocker but must use a password or USB key, and you need to change Group Policy to 'Allow BitLocker without a compatible TPM'.
'Recovery key escrow': you must know that recovery keys should be saved to Microsoft Entra ID or Active Directory. A common trap question asks where to store recovery keys for cloud-joined devices — answer is Microsoft Entra ID, not a local file.
'Encryption method': the exam will test the difference between 'Used Disk Space Only' vs 'Full Disk Encryption'. Used space encrypts only the parts of the drive that contain data (faster, but new data is not encrypted until written). Full disk encrypts every sector (more secure). For new devices, full disk is recommended. For existing devices with data, used space is common to save time.
'Pre-boot authentication': questions ask when to require a PIN versus password. The answer — PIN is more secure because it can include numbers and sometimes letters, but password is easier for users. The exam may ask which setting enforces PIN complexity: look for 'Require startup PIN' in the policy.
'Key protectors': the exam will list options (TPM, TPM+PIN, TPM+password, recovery key, password) and ask which is most secure — TPM+PIN is the strongest.
'Group Policy vs Intune': be ready to identify where settings are configured. For MD-102, Intune is the preferred method for modern managed devices (Microsoft Entra Joined). Legacy devices on-premises use Group Policy. The exam may ask: 'You manage devices with both — which takes precedence?' Typically Intune wins if both are applied unless there is a conflict resolution setting.
'Device encryption vs BitLocker': the exam tests that device encryption is automatic on modern consumer devices but has limited manageability. For full enterprise control, use BitLocker with policies.
'Suspended BitLocker': a trap concept. BitLocker can be 'suspended' during firmware updates to avoid recovery key prompts. The exam asks: what happens when you suspend BitLocker? The drive remains encrypted, but the TPM protector is cleared. You must resume BitLocker after the update.
'Silent encryption': questions about deploying encryption without user interaction. The correct method is to configure the policy in Intune and have Windows automatically encrypt during the provisioning process.
'Recovery password ID': the 48-digit recovery key has an associated 8-digit 'Key ID' that helps IT identify which key to use. The exam might present a scenario where a user reads the 8-digit ID, and you must select the matching recovery password.
Common traps on the exam:
Confusing 'recovery key' with 'recovery password' — they are the same thing (48-digit number).
Thinking BitLocker works on Windows Home — it does not; you need Pro or Enterprise.
Assuming that suspending BitLocker turns off encryption — it does not; encryption remains but the key is temporarily unprotected.
Forgetting that the recovery key is a 48-digit number, not a file. The file option is for the 'startup key', which is different.
To memorise: the BitLocker deployment workflow — check TPM, create policy, assign policy, escrow key, encrypt, verify compliance.
BitLocker uses AES encryption with a 128-bit or 256-bit key to protect the entire drive at rest.
The TPM chip is a hardware component that securely stores the encryption key and releases it only if the system has not been tampered with.
Recovery keys (48-digit passwords) must be escrowed to Microsoft Entra ID or Active Directory before encrypting enterprise devices.
Pre-boot authentication (PIN or password) adds an extra layer of security beyond TPM-only protection.
BitLocker policies in Intune or Group Policy automate encryption and enforce compliance across an organisation.
Device encryption is a simplified version of BitLocker that requires a Microsoft account and is enabled by default on InstantGo-capable devices.
Suspending BitLocker during firmware updates keeps the drive encrypted but clears the TPM protector temporarily.
Full disk encryption encrypts every sector, while used space only encryption encrypts just the parts containing data.
BitLocker is available only on Windows Pro, Enterprise, and Education editions — not on Windows Home.
The recovery key has an 8-digit key ID that helps IT identify the correct key among many stored keys.
These come up on the exam all the time. Here's how to tell them apart.
BitLocker
Available on Windows Pro, Enterprise, Education editions only.
Full manageability through Group Policy or Intune policies.
Supports pre-boot authentication, multiple key protectors, and advanced recovery options.
Device Encryption
Enabled by default on many modern consumer devices with InstantGo support.
Limited to signing in with a Microsoft account to escrow the recovery key.
No custom policy settings; uses default encryption method (AES 128-bit) and no pre-boot PIN.
TPM-only Protection
Drive unlocks automatically when the system boots and passes TPM integrity checks.
No user input required at startup; seamless experience.
Less secure: an attacker with physical access could boot the system if TPM is fooled.
TPM+PIN Protection
Requires the user to enter a PIN on a blue screen before Windows loads.
Adds a second factor of authentication (something you know plus the TPM).
More secure: even if TPM is compromised, the PIN is needed to decrypt the drive.
Used Disk Space Only Encryption
Only encrypts sectors that already contain data; empty space remains unencrypted.
Faster to enable on existing drives, especially large ones with sparse data.
New data written to unencrypted space is encrypted automatically as it is written.
Full Disk Encryption
Encrypts every sector of the drive, including empty space and slack space.
Takes longer to enable initially, but provides maximum security against forensic recovery.
Recommended for new devices during initial provisioning to minimise compliance gaps.
Recovery Key (48-digit password)
A 48-digit numerical password that can be entered manually when prompted.
Often stored in Microsoft Entra ID or printed and kept in a safe.
Does not require a physical token; can be provided over the phone.
Startup Key (USB drive)
A file stored on a USB flash drive that must be inserted during boot.
Requires the USB drive to be present; if lost, the device cannot be unlocked.
Less practical for enterprise remote support because the user must have the USB key physically.
Mistake
BitLocker protects the computer from malware and viruses.
Correct
BitLocker only encrypts the drive to prevent unauthorised access to data if the device is lost or stolen. It does not replace antivirus software.
The word 'protection' sounds general, so beginners assume it covers all security threats. They conflate encryption with general security software.
Mistake
Once BitLocker is enabled, you can never remove it without wiping the drive.
Correct
You can turn off BitLocker entirely, which will decrypt the drive. The data remains intact.
The term 'encryption' implies permanence to many people, similar to how 'locked' suggests you cannot unlock.
Mistake
BitLocker encrypts only the user's files, not the operating system files.
Correct
BitLocker encrypts the entire volume, including system files, swap files, and temporary files. It is full-volume encryption.
Users are familiar with file-level encryption tools (like encrypting a Word document), so they assume BitLocker works the same way.
Mistake
If you forget your BitLocker PIN, the data is lost forever.
Correct
If you have the recovery key (48-digit password) stored in Microsoft Entra ID or Active Directory, you can unlock the drive. The data is recoverable.
This belief stems from personal experience with password-only encryption (like a ZIP file password), where there is no recovery mechanism.
Mistake
BitLocker slows down the computer significantly because it is constantly encrypting and decrypting.
Correct
Modern CPUs have dedicated instructions for AES encryption, so the performance impact is negligible (usually less than 5%). Users do not notice it.
The idea of 'constant scrambling' sounds resource-intensive, but hardware acceleration makes it efficient.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
No, BitLocker is not available on Windows Home editions. You need Windows Pro, Enterprise, or Education. Devices running Windows 11 Home may have 'device encryption' instead, which is simpler.
If the recovery key is not escrowed, the data might be permanently inaccessible if the TPM fails or the PIN is forgotten. Always ensure the key is backed up to Microsoft Entra ID, AD, or a printout.
BitLocker can encrypt the operating system drive (usually C:) and any fixed data drives (like D:). It does not typically encrypt removable drives unless you use BitLocker To Go for USB drives.
Yes, you can change the PIN by opening the BitLocker control panel and selecting 'Change PIN'. You will need to enter the current PIN and the new one.
Suspending BitLocker temporarily removes the TPM protector but keeps the drive encrypted. Disabling BitLocker decrypts the drive entirely. Suspending is used for firmware updates; disabling is for permanent removal.
Open the BitLocker control panel by searching for 'BitLocker' in the Start menu. It will show the status for each drive: Off, On, or Suspended.
Yes, you can use Microsoft Intune to deploy BitLocker policies, monitor compliance, and access recovery keys for thousands of devices from a single console.
You've finished Implementing BitLocker and Device Encryption. Continue through the MD-102 study guide to build a complete picture of the exam.
Done with this chapter?