BitLocker silent encryption not starting on Intune-managed devices: causes and fixes

You assigned a BitLocker policy in Intune, but devices stay unencrypted, or users get a prompt instead of silent encryption. Silent encryption is a chain of hardware prerequisites and policy settings, and one weak link stops it. In this post I'll go through each link, the logs that point to the broken one, and what a healthy device looks like.

Symptoms#

• Devices › Monitor › Encryption report lists devices as not encrypted or not ready for encryption.
• manage-bde -status shows the OS drive as fully decrypted with protection off.
• Users see a BitLocker prompt, or nothing happens at all.
• A compliance policy that requires BitLocker keeps the device noncompliant.

Why it happens#

Intune delivers the settings through the BitLocker CSP. On the device, the BitLocker MDM policy Refresh scheduled task copies them into the BitLocker policy registry; BitLocker then checks the hardware, backs up recovery information to Microsoft Entra ID and only then encrypts. Silent enablement needs:

• Windows 11 (Windows 10 needs 1803 or later for administrators, 1809 or later for standard users).
• A device that's Microsoft Entra joined or Microsoft Entra hybrid joined.
• A TPM, version 1.2 or later, enabled and ready.
• Native UEFI mode with Secure Boot on. Legacy BIOS isn't supported for silent encryption.
• A working Windows Recovery Environment (WinRE).

On the policy side, silent encryption fails if the profile still leaves a step for the user:

With the template, also set User creation of recovery key to Allow or Do not allow 256-bit recovery key, and User creation of recovery password to Allow or Require 48-digit recovery password. Older guides, written for the previous endpoint security profile format, call the warning and standard-user settings Hide prompt about third-party encryption and Allow standard users to enable encryption during Autopilot.

How to fix it#

1. Start with the encryption report. In Devices › Monitor › Encryption report, check readiness, encryption status and TPM version, then select the device. Its status details are codes returned by the BitLocker CSP and can point straight at the missing prerequisite.
2. Check the hardware on the device. In an elevated PowerShell window:
   PowerShell

   manage-bde -status C:
   reagentc /info
   Get-Tpm | Select-Object TpmPresent, TpmReady
   Confirm-SecureBootUEFI

   You want Windows RE status: Enabled, both TPM values True and Secure Boot True. If Confirm-SecureBootUEFI reports the cmdlet isn't supported on this platform, the device either lacks Secure Boot support or boots in legacy BIOS mode; msinfo32 shows which under BIOS Mode.
3. Read the BitLocker log. Errors land in Applications and Services Logs › Microsoft › Windows › BitLocker-API › Management:
   PowerShell

   Get-WinEvent -LogName 'Microsoft-Windows-BitLocker/BitLocker Management' -MaxEvents 40 |
       Where-Object { $_.Level -in 1, 2, 3 } |
       Format-List TimeCreated, Id, Message

   Match what you find against the table below. If this log is clean, check DeviceManagement-Enterprise-Diagnostics-Provider › Admin for errors on ./Device/Vendor/MSFT/BitLocker/... paths, which mean the policy itself didn't apply.
4. Remove conflicting policy. Give each device one BitLocker profile, look for Conflict in per-setting status, and review baselines and GPOs on hybrid devices. A "conflicting Group Policy settings" error means two settings contradict each other. The values the device received are under HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker.
5. Confirm key escrow can succeed. The device must be properly joined (dsregcmd /status), because recovery information is backed up to Microsoft Entra ID before encryption. Microsoft Entra ID stores at most 200 recovery keys per device; at that limit the backup fails and so does silent encryption.

Verify the fix#

• manage-bde -status C: shows Conversion Status as Used Space Only Encrypted or Fully Encrypted, Protection Status as Protection On, and key protectors that include TPM and Numerical Password.
• In Intune, Devices › All devices, select the device, then Recovery keys: the key ID and key are listed. Viewing them needs microsoft.directory/bitlockerKeys/key/read, included in Cloud Device Administrator, Helpdesk Administrator and Global Administrator.
• The encryption report shows the device as encrypted. A compliance policy that requires BitLocker only measures it at boot, so restart before judging compliance.

Prevent it next time#

• Inventory devices for third-party disk encryption before assigning a silent policy, because the warning you disable is the one that protects against double encryption.
• Build images in UEFI mode with Secure Boot and leave the recovery partition intact.
• Give BitLocker settings one owner, and re-check baselines whenever you update them.
• Pilot every BitLocker change on a small group before broad assignment.

References#

• Encrypt Windows devices with BitLocker using Intune
• Enforcing BitLocker policies by using Intune: known issues
• Troubleshooting BitLocker policies from the client side