BitLocker With Intune: Encrypt Laptops and Escrow Keys in Texas 2026

Houston-area teams travel, work from client sites, and take laptops home. Cars get broken into and bags get left at airports. When an unencrypted device disappears, you may have to assume the data on it was exposed, and that triggers questions under Texas breach notification requirements, your cyber insurance policy, and any client contracts that require encryption at rest.

Encryption also appears on nearly every security questionnaire. Carriers, healthcare partners, and law firm clients routinely ask whether laptops are encrypted and whether you can prove it. A policy you can report on in a console beats a verbal yes.

BitLocker encrypts the entire Windows drive so its contents are unreadable without the right key. On modern business laptops the key is protected by the TPM chip, so the device unlocks normally for the signed-in user and stays locked if the drive is removed and read elsewhere. A separate recovery key is the fallback if the TPM detects a hardware or firmware change and asks for it at boot.

The recovery key is where small businesses get hurt. Encryption without key escrow means a routine BIOS update or motherboard swap can lock a user out of their own data with nobody able to help.

If your devices are enrolled in Intune, you can turn on encryption silently, with no user prompts. This builds on the same foundation as your Intune device compliance policies.

1. Confirm hardware readiness. Check that devices have TPM 2.0 and are running a supported Windows 11 or Windows 10 business edition.
2. Create an endpoint security policy. In Intune, open Endpoint security, then Disk encryption, and create a BitLocker policy for Windows.
3. Require XTS-AES 256 or 128. Either is strong. Pick one and apply it consistently across all devices.
4. Enable silent encryption. Allow the policy to encrypt the OS drive without user interaction when the device is eligible.
5. Escrow recovery keys to Entra ID. Require that the recovery key is backed up to the cloud before encryption begins.
6. Pilot first. Assign the policy to a small group, confirm keys appear on the device record in Entra, then expand to everyone.

New machines provisioned through Windows Autopilot zero-touch deployment can arrive already encrypted, with the key escrowed before the employee ever signs in.

Anyone who can read a recovery key can unlock that drive, so treat the key vault with the same care as privileged access. Limit key retrieval to a small support role, require MFA for those accounts through Entra Conditional Access policies, and review retrieval logs on a regular schedule. This pairs naturally with Windows LAPS for local admin passwords, since both rely on the same principle: secrets live in a protected cloud vault, not in a spreadsheet.

Also decide what happens when an employee leaves. Retrieve and rotate keys on returned hardware as part of your IT asset lifecycle process so a repurposed laptop never carries an old key forward.

• Encrypting without escrow. Users get locked out and the only fix is a wipe.
• Forgetting personal devices. Phones and BYOD laptops need their own protections, covered in our BYOD policy guide and mobile device security guide.
• Skipping reporting. If you cannot show which devices are encrypted, you cannot answer an auditor or an insurer with confidence.
• Ignoring removable media. USB drives that carry client files deserve the same policy as the laptop.
• Leaving old keys in play. Rotate recovery keys after anyone uses one to unlock a device.

Encryption at rest is a baseline expectation in HIPAA, the FTC Safeguards Rule, and CMMC, and it is a common line item on cyber insurance requirements. For healthcare practices, it is also a core safeguard in HIPAA compliance for Houston healthcare, where lost encrypted devices are generally treated very differently from lost unencrypted ones. Documented, centrally enforced encryption also supports the reasonable security program described in Texas SB 2610 safe harbor guidance. See how peers compare in our Texas SMB IT and cybersecurity benchmark.

Pull a list of your laptops and check how many show as encrypted with a recovery key stored in Entra ID. Any gap is your first pilot group. If you want help, our IT support team can build and test the Intune policy, and our Microsoft 365 managed services and cybersecurity services keep encryption and key access monitored. Houston-area businesses can start with a same-week review from our Houston managed IT team.

• Houston managed IT
• Katy managed IT
• Cypress managed IT