Your organization uses Microsoft Intune to manage Windows 10 devices. You need to enforce BitLocker encryption on all devices. Some devices are not encrypting. You check the BitLocker policy and it is assigned correctly. What is the most likely reason?
TPM is required for BitLocker.
Why this answer
BitLocker requires a TPM (Trusted Platform Module) version 1.2 or later to provide hardware-based key storage and integrity verification. If a device lacks a TPM chip, the BitLocker policy will not apply, and encryption will fail silently or remain off, even if the policy is correctly assigned. This is the most common cause of encryption not starting on Windows 10 devices managed by Intune.
Exam trap
The trap here is that candidates often assume the issue is policy assignment or user targeting, but Microsoft Intune's BitLocker policy has a hard dependency on TPM hardware, making the absence of a TPM the most likely root cause when encryption fails on correctly targeted devices.
How to eliminate wrong answers
Option A is wrong because Windows 10 Home edition does not support BitLocker at all, but the question states some devices are not encrypting, implying others are—so the issue is not edition-wide. Option C is wrong because the question explicitly states the BitLocker policy is assigned correctly, so user assignment is not the problem. Option D is wrong because non-compliance does not block BitLocker encryption; Intune can enforce encryption regardless of compliance status, and non-compliance typically triggers remediation or reporting, not a block on encryption.