bitlocker-design
Guidance for designing BitLocker drive encryption for Windows endpoints managed via Microsoft Intune — encryption policy, key escrow, silent enablement, and recovery. Covers disk encryption policy, TPM, and recovery key management. WHEN: BitLocker, disk encryption, Windows encryption policy, BitLocker recovery key, silent BitLocker enablement, Intune disk encryption, TPM, escrow recovery key, encrypt endpoints.
Works with
--- name: bitlocker-design description: Guidance for designing BitLocker drive encryption for Windows endpoints managed via Microsoft Intune — encryption policy, key escrow, silent enablement, and recovery. Covers disk encryption policy, TPM, and recovery key management. WHEN: BitLocker, disk encryption, Windows encryption policy, BitLocker recovery key, silent BitLocker enablement, Intune disk encryption, TPM, escrow recovery key, encrypt endpoints. license: MIT --- # BitLocker Design BitLocker provides full-volume encryption for Windows devices, protecting data at rest against device loss/theft. In modern, cloud-managed estates it is deployed and monitored through Microsoft Intune disk encryption policies. ## When to use Encrypting Windows endpoints and centrally managing recovery keys and compliance. ## Approach 1. **Prerequisites** — Confirm **TPM** (2.0 recommended), supported Windows edition, and Entra/hybrid join for key escrow. 2. **Policy** — Configure Intune **disk encryption** (endpoint security) BitLocker policy: OS drive and fixed-drive settings, encryption method (e.g., XTS-AES 256), and pre-boot authentication requirements. 3. **Silent enablement** — Use settings that **silently enable** BitLocker and **escrow recovery keys to Microsoft Entra ID** automatically, minimising user disruption. 4. **Recovery management** — Ensure recovery keys are stored in Entra ID; define admin/self-service recovery key retrieval and help-desk processes. 5. **Compliance** — Add BitLocker/encryption to Intune **compliance policy** so Conditional Access can require encrypted devices. 6. **Monitor** — Track encryption status via Intune encryption reports. ## Guardrails - Verify recovery key escrow is working **before** broad rollout — un-escrowed keys risk data loss. - Pilot pre-boot authentication choices; they affect user experience and automation/imaging. - Removable-drive encryption (BitLocker To Go) is a separate policy decision. ## Example prompts - `Design a BitLocker policy with silent enablement via Intune.` - `How do I escrow BitLocker recovery keys and run a help-desk recovery process?` - `Enforce disk encryption on Windows endpoints with TPM.` - `Plan BitLocker key management and recovery at scale.` ## Microsoft Learn - BitLocker overview: https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/ - Manage with Intune: https://learn.microsoft.com/mem/intune/protect/encrypt-devices - Disk encryption policy: https://learn.microsoft.com/mem/intune/protect/endpoint-security-disk-encryption-policy - Recovery keys in Entra: https://learn.microsoft.com/entra/identity/devices/manage-device-identities
More Security skills
azure-cost
microsoft/azure-skills
Azure cost management: query costs, forecast spending, optimize to reduce waste. WHEN: \"Azure costs\", \"Azure bill\", \"cost breakdown\", \"how much am I spending\", \"forecast spending\", \"optimize costs\", \"reduce spending\", \"orphaned resources\", \"rightsize VMs\", \"cost spike\", \"reduce storage costs\", \"AKS cost\". DO NOT USE FOR: deploying resources, provisioning, diagnostics, or security audits.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
azure-messaging
microsoft/azure-skills
Troubleshoot and resolve issues with Azure Messaging SDKs for Event Hubs and Service Bus. Covers connection failures, authentication errors, message processing issues, and SDK configuration problems. WHEN: event hub SDK error, service bus SDK issue, messaging connection failure, AMQP error, event processor host issue, message lock lost, message lock expired, lock renewal, lock renewal batch, send timeout, receiver disconnected, SDK troubleshooting, azure messaging SDK, event hub consumer, service bus queue issue, topic subscription error, enable logging event hub, service bus logging, eventhub python, servicebus java, eventhub javascript, servicebus dotnet, event hub checkpoint, event hub not receiving messages, service bus dead letter, batch processing lock, session lock expired, idle timeout, connection inactive, link detach, slow reconnect, session error, duplicate events, offset reset, receive batch.
