BitLocker and device encryption errors with Intune: report statuses, codes and fixes

When Intune can't encrypt a Windows device, the evidence is spread across three places: sentences in the encryption report, numeric status values in the BitLocker CSP and messages in the BitLocker-API log. This quick reference maps all of them, including every documented status bit, the key rotation status values, CSP errors and the messages that stop silent encryption, to the usual cause and the first check.

How to read these codes#

In the Microsoft Intune admin center, go to Devices › Manage devices › Configuration, open the Monitor tab and select Device encryption status. The report shows the TPM version, Encryption readiness and Encryption status for each device; select a device to see Status details. Keep three facts in mind:

• Encryption status only covers the OS drive. Fixed data drives show up in the status details instead.
• Status details are the decoded bits of the BitLocker CSP node Status/DeviceEncryptionStatus, shown for Windows 10 (April 2019 Update or later) and Windows 11. One device can report several.
• Reporting lags: Microsoft allows up to 24 hours for a status change to reach the report.

The CSP itself returns a single number. 0 means compliant; anything else is a bitmask, so a value of 4352 is bit 12 (4096) plus bit 8 (256). This decodes any value:

$value = 4352
0..17 | Where-Object { $value -band (1 -shl $_) } |
    ForEach-Object { "Bit $_ (value $(1 -shl $_))" }

On the device, policy delivery errors land in DeviceManagement-Enterprise-Diagnostics-Provider › Admin (look for ./Device/Vendor/MSFT/BitLocker/... paths), prerequisite errors in Applications and Services Logs › Microsoft › Windows › BitLocker-API › Management, and TPM hardware errors in the System log from the TPMProvisioningService or TPM-WMI sources. Microsoft's client-side BitLocker troubleshooting guide walks through each log.

Encryption readiness values#

Status details: DeviceEncryptionStatus bits#

The Code column shows the bit and, in brackets, the value it adds to the CSP number. The Meaning column paraphrases the status detail text Intune displays.

Key rotation status: RotateRecoveryPasswordsStatus#

A recovery password rotation requested through the CSP reports its progress here. It needs Windows 10, version 1909 or later, a Microsoft Entra joined or hybrid joined device, and the recovery options that require backup before encryption. Intune's key rotation device action depends on the same prerequisites.

Policy and task errors#

To see which settings the device actually received, compare HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker with HKLM\SOFTWARE\Policies\Microsoft\FVE, or use the MDM diagnostic report as described in finding Intune policy conflicts.

BitLocker-API messages that stop silent encryption#

Two related messages already have their own guides: escrow failures (events 846 and 778, including 0x80072f9a) in the key escrow guide, and the Secure Boot "UEFI variable 'SecureBoot' could not be read" error in BitLocker silent encryption not starting. Security baselines can also switch on a startup PIN or key, which blocks silent encryption; see security baseline conflicts.

How to verify a fix#

1. Sync from Settings › Accounts › Access work or school, select the account, then Info › Sync.
2. Check the device in an elevated PowerShell window:
   PowerShell

   manage-bde -status C:
   manage-bde -protectors -get C:
   Get-Tpm | Select-Object TpmPresent, TpmReady
   reagentc /info
   Get-WinEvent -LogName 'Microsoft-Windows-BitLocker/BitLocker Management' -MaxEvents 30 |
       Where-Object Id -in 845, 846, 851, 853, 854 |
       Format-List TimeCreated, Id, Message

   Good looks like Protection On, a TPM protector plus a Numerical Password protector, TpmReady True, Windows RE status Enabled and a recent 845 with no new errors. When Secure Boot is in use, the TPM protector's PCR Validation Profile includes 7.
3. In Intune, the device should show Encryption status Encrypted with empty status details, and the key should appear on its Recovery keys page. Allow up to 24 hours for the report.
4. A compliance policy that requires BitLocker is measured at boot, so restart before judging compliance.

References#

• BitLocker CSP
• Monitor device encryption with Intune
• Enforcing BitLocker policies by using Intune: known issues