BitLocker silent encryption not starting on Intune-managed devices: causes and fixes

Symptoms to confirm

• Devices › Monitor › Encryption report lists devices as not encrypted or not ready for encryption.
• manage-bde -status shows the OS drive as fully decrypted with protection off.
• Users see a BitLocker prompt, or nothing happens at all.
• A compliance policy that requires BitLocker keeps the device noncompliant.

Likely causes

Intune delivers the settings through the BitLocker CSP.

• Windows 11 (Windows 10 needs 1803 or later for administrators, 1809 or later for standard users).
• A device that's Microsoft Entra joined or Microsoft Entra hybrid joined.
• A TPM, version 1.2 or later, enabled and ready.
• Native UEFI mode with Secure Boot on. Legacy BIOS isn't supported for silent encryption.
• A working Windows Recovery Environment (WinRE).

Note: Modern Standby and HSTI are requirements for Windows automatic device encryption, not for Intune silent encryption. They still affect the result: modern standby devices get used-space-only encryption by default, other devices get full-disk encryption.

Watch out: The settings catalog lacks the TPM startup authentication controls needed for reliable silent enablement, so use the endpoint security profile or the template. Also check security baselines: Microsoft warns that a Defender security baseline can enable a startup PIN or key, which quietly blocks silent encryption.

Checklist

1. 1

   Start with the encryption report

   In Devices › Monitor › Encryption report, check readiness, encryption status and TPM version, then select the device. Its status details are codes returned by the BitLocker CSP and can point straight at the missing prerequisite.

2. 2

   Check the hardware on the device

   In an elevated PowerShell window:

   powershell

   manage-bde -status C:
   reagentc /info
   Get-Tpm | Select-Object TpmPresent, TpmReady
   Confirm-SecureBootUEFI

3. 3

   Read the BitLocker log

   Errors land in Applications and Services Logs › Microsoft › Windows › BitLocker-API › Management:

   powershell

   Get-WinEvent -LogName 'Microsoft-Windows-BitLocker/BitLocker Management' -MaxEvents 40 |
       Where-Object { $_.Level -in 1, 2, 3 } |
       Format-List TimeCreated, Id, Message

4. 4

   Remove conflicting policy

   Give each device one BitLocker profile, look for Conflict in per-setting status, and review baselines and GPOs on hybrid devices. A "conflicting Group Policy settings" error means two settings contradict each other.

5. 5

   Confirm key escrow can succeed

   The device must be properly joined (dsregcmd /status), because recovery information is backed up to Microsoft Entra ID before encryption. Microsoft Entra ID stores at most 200 recovery keys per device; at that limit the backup fails and so does silent encryption.

Verify

• manage-bde -status C: shows Conversion Status as Used Space Only Encrypted or Fully Encrypted, Protection Status as Protection On, and key protectors that include TPM and Numerical Password.
• In Intune, Devices › All devices, select the device, then Recovery keys: the key ID and key are listed. Viewing them needs microsoft.directory/bitlockerKeys/key/read, included in Cloud Device Administrator, Helpdesk Administrator and Global Administrator.
• The encryption report shows the device as encrypted. A compliance policy that requires BitLocker only measures it at boot, so restart before judging compliance.

Prevent it next time

• Inventory devices for third-party disk encryption before assigning a silent policy, because the warning you disable is the one that protects against double encryption.
• Build images in UEFI mode with Secure Boot and leave the recovery partition intact.
• Give BitLocker settings one owner, and re-check baselines whenever you update them.
• Pilot every BitLocker change on a small group before broad assignment.