Github Documentation sample: Microsoft Learn–Style How-To Configure BitLocker Drive Encryption Policies with Intune
Introduction This tutorial shows how to use Microsoft Intune to enforce BitLocker encryption policies across Windows 10 and 11 devices. Learning Objectives Apply BitLocker policy settings via Intune Enforce TPM-based encryption Require startup PINs or passwords Prerequisites Microsoft Intune tenant Windows 10/11 Pro or Enterprise devices Devices enrolled in Intune and AAD-joined Instructions Step 1: Create a BitLocker Policy In MEM admin center, go to Devices > Configuration profiles > + Create profile Platform: Windows 10 and later Profile type: Endpoint protection Name your policy (e.g., “BitLocker Enforcement Policy”) Step 2: Configure BitLocker Settings Navigate to Windows Encryption section Enable the following: Require encryption for operating system drive Allow standard users to enable encryption Require TPM + PIN at startup (if applicable) Configure fixed and removable drive encryption if needed Step 3: Assign the Policy Go to Assignments Choose the appropriate dev...