Configure the BitLocker Policy CSP in your MDM by enforcing TPM-based protection, enabling encryption for Operating System (System), Fixed data, and Removable data drives, selecting the encryption method, and configuring Recovery options (recovery password/key backup). Once the policy is applied, eligible Windows Pro devices automatically start BitLocker encryption.
It works by:
- Enable automatic drive encryption through MDM.
- Verify prerequisites such as TPM enabled, Secure Boot State = On, and BIOS Mode = UEFI (check using Win + R → msinfo32).
- BitLocker encryption starts automatically once all requirements are met.
