MT.1123: Ensure BitLocker full disk encryption is configured

ID	MT.1123
Severity	High
Suite	Mito
Product	Intune
Feature	Endpoint security
Security area	Devices and endpoints
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Medium
Framework controls	nist-800-53-r5:SC-28(1) Protection of Information at Rest | Cryptographic Protection
MITRE ATT&CK	T1005
Reads from	Microsoft Graph
Licence needed	INTUNE_A

What this checks and how to fix it

Ensure at least one Intune policy enforces BitLocker full encryption on operating system drives.

BitLocker offers two encryption types, and the difference matters:

• Full encryption encrypts the entire drive, including free space.
• Used Space Only encryption encrypts only the sectors that currently hold data.

Used Space Only is the risk. When NTFS deletes a file it marks those sectors as free without zeroing them, so the original bytes stay on disk until something overwrites them. Enable BitLocker with Used Space Only on a drive that already held data and everything deleted beforehand remains recoverable with ordinary tools such as Recuva or PhotoRec, or with forensic imaging. Only Full encryption protects the whole drive surface.

BitLocker can be configured from either Endpoint security > Disk encryption or Devices > Configuration > Settings catalog. Both write the same settings, and both satisfy this check.

Remediation action

1. Navigate to Microsoft Intune admin center.
2. Go to Endpoint security > Disk encryption.
3. Click + Create policy.
4. Set Platform to Windows 10 and later and Profile to BitLocker.
5. Enter a policy name (e.g., “BitLocker - Full Disk Encryption”).
6. Configure the following settings:
   • Require Device Encryption: Enabled
   • Allow Warning For Other Disk Encryption: Disabled (enables silent encryption)
   • Allow Standard User Encryption: Enabled
   • Enforce drive encryption type on operating system drives: Enabled, set to Full encryption
   • Enforce drive encryption type on fixed data drives: Enabled, set to Full encryption
   • Choose drive encryption method and cipher strength: Enabled
     • OS drives: XTS-AES 256-bit
     • Fixed data drives: XTS-AES 256-bit
     • Removable data drives: AES-CBC 256-bit
   • Require additional authentication at startup: Enabled, with Require TPM
   • Choose how BitLocker-protected OS drives can be recovered: Enabled, with backup to Entra ID
7. Assign the policy to your device groups and click Create.

Related links

• Microsoft Intune - Endpoint Security Disk Encryption
• Microsoft Learn - Encrypt devices with BitLocker in Intune
• Microsoft Learn - BitLocker CSP reference
• CIS Benchmark - Ensure BitLocker is enabled on all Windows devices

---

Mito check. Author: OfirGavish; contributors: royklo. Open-source licences.