Configuring BitLocker with TPM Protector and Azure AD Recovery Key in Intune
You have a Microsoft Intune environment with devices running Windows 10 and 11. You need to configure a policy that enforces BitLocker drive encryption with a TPM protector and stores recovery key in Microsoft Entra ID. Which three settings must you configure in the endpoint protection profile? (Choose three.)
Quick Answer
The correct answer is to enable BitLocker, configure TPM as a protector, and specify Microsoft Entra ID as the recovery key storage. These three settings work together because the TPM protector validates the device’s integrity before unlocking the OS drive, while storing the recovery key in Entra ID ensures that administrators can retrieve it if the TPM fails or the user forgets their PIN. On the MD-102 exam, this scenario tests your understanding of how endpoint protection profiles in Intune enforce hardware-based encryption and cloud-backed key escrow—a common trap is confusing encryption method settings or OS drive encryption with the specific protector and recovery storage choices. Remember the memory tip: “TPM locks the door, Entra holds the spare key.”
⚠ Common exam trap
Many exam-takers confuse the 'Require encryption of OS drive' as a separate mandatory setting, when in fact it is automatically enforced by the 'Enable BitLocker' setting, making it redundant to select both.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store recovery key in Microsoft Entra ID
The 'Store recovery key in Microsoft Entra ID' setting ensures that the BitLocker recovery key is automatically backed up to the user's Microsoft Entra ID object. This is essential for recovery scenarios and is a key requirement for managing BitLocker via Intune, as it allows administrators to retrieve the key from the Entra admin center.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store recovery key in Microsoft Entra ID
Why this is correct
Recovery key storage must be set to Microsoft Entra ID.
- ✗
Require encryption of OS drive
Why it's wrong here
This is automatically done when BitLocker is enabled.
- ✗
Choose encryption method (XTS-AES 128-bit)
Why it's wrong here
Encryption method is unrelated to recovery key storage.
- ✓
Enable BitLocker
Why this is correct
BitLocker must be enabled.
- ✓
Configure TPM as a protector
Why this is correct
TPM must be selected as a protector.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 942 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MD-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization wants to enforce encryption on all Windows 10/11 devices using Intune. Which policy type should they use?
easy- A.Device compliance policy
- B.App protection policy
- C.Device configuration profile (settings catalog)
- ✓ D.Endpoint security disk encryption policy
Why D: The Endpoint security disk encryption policy in Intune is specifically designed to enforce encryption (e.g., BitLocker) on Windows 10/11 devices. It provides a dedicated, streamlined interface for configuring encryption settings and monitoring compliance, unlike general device configuration profiles which require manual setup via the settings catalog. This policy type is the correct choice because it directly targets disk encryption as a security baseline, aligning with the organization's goal to enforce encryption across all managed devices.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.