Configuring BitLocker Encryption Policy in Microsoft Intune
Your organization uses Microsoft Intune to manage Windows 11 devices. You have a requirement to ensure that all devices have BitLocker Drive Encryption enabled with a TPM protector and a recovery key escrowed to Azure AD. Additionally, you need to configure a policy that prevents users from changing the BitLocker settings. You create a device configuration profile using the 'Endpoint Protection' template for Windows 10 and later. After deploying the policy to a test group, you notice that BitLocker is not enabled on some devices. The devices meet the hardware requirements and are Azure AD joined. What is the most likely reason for the failure, and how should you resolve it?
Quick Answer
The most likely reason BitLocker is not enabling is that the policy is missing the explicit 'Enable full disk encryption' setting and a specified encryption method under the Windows Encryption section of the Endpoint Protection profile. Even when you configure a TPM protector and recovery key escrow to Azure AD, the Intune policy will not trigger the encryption process unless you toggle the "Enable full disk encryption" option and select a method like XTS-AES 128-bit. This is a common trap on the MD-102 exam: candidates assume that configuring protectors and key escrow alone will start encryption, but the policy must explicitly command the device to encrypt. The exam tests your understanding that the Endpoint Protection template requires granular enablement settings, not just security configurations. A reliable memory tip is "No toggle, no encrypt"—if you don't flip the enable switch and choose a cipher, BitLocker stays dormant regardless of other settings.
⚠ Common exam trap
It's easy for candidates to assume configuring TPM protector and recovery key escrow is sufficient to enable BitLocker, but the 'Enable full disk encryption' setting is a separate mandatory toggle that must be explicitly enabled in the policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy is missing the 'Enable full disk encryption' setting or the encryption method is not specified; check the 'Windows Encryption' settings in the profile.
The 'Endpoint Protection' template for Windows 10 and later requires explicit configuration of the 'Enable full disk encryption' setting and the encryption method (e.g., XTS-AES 128-bit) under the 'Windows Encryption' section. Without these settings, the policy does not trigger BitLocker to start encryption on the device, even if other settings like TPM protector and recovery key escrow are configured. The devices are Azure AD joined and meet hardware requirements, so the missing encryption enablement is the most likely cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Devices are not hybrid Azure AD joined; convert them to hybrid join for BitLocker policy to apply.
Why it's wrong here
Azure AD joined devices can receive BitLocker policy without hybrid join.
- ✗
The policy does not specify a recovery key escrow location; configure it to escrow to Azure AD.
Why it's wrong here
The scenario already mentions the recovery key should be escrowed to Azure AD, and the policy likely includes that setting.
- ✓
The policy is missing the 'Enable full disk encryption' setting or the encryption method is not specified; check the 'Windows Encryption' settings in the profile.
Why this is correct
The 'Encryption method' and 'Enable full disk encryption' settings must be configured in the profile for BitLocker to be enabled.
- ✗
Devices are not co-managed with Configuration Manager; enable co-management to apply BitLocker policy.
Why it's wrong here
Co-management is not required for BitLocker policy via Intune.
Visual reference
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Configuration profile
A configuration profile is a set of settings and policies that can be applied remotely to devices to enforce security, compliance, and customization rules.
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MD-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization has a mix of Windows 10 and Windows 11 devices managed by Intune. You need to enforce BitLocker encryption on all devices. Which policy type should you configure?
medium- A.Device configuration profile with Administrative Templates.
- ✓ B.Endpoint Protection profile in Device restrictions.
- C.Device compliance policy.
- D.Windows Update ring policy.
Why B: The correct policy type is an Endpoint Protection profile within Device restrictions, because BitLocker settings for Windows 10/11 devices managed by Intune are configured under the 'Windows Encryption' category of an Endpoint Protection profile. This profile directly controls BitLocker drive encryption, including encryption method, recovery key management, and silent encryption enforcement, which is required for the scenario.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.