# Bitlocker Policy Association & Deployment

Last Updated On: 23 Jul 2026  
6 minutes read

Associate a BitLocker policy with a target group, deploy it, and confirm devices actually encrypt.

## Associating a policy with targets

A policy has to be linked to a target group before it can deploy.

### How association works

A policy created in the BitLocker module (see [policy creation](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-policy-creation.html)) has to be associated with a target before it deploys anywhere.

Supported target types are static computer groups, static unique computer groups, and dynamic computer groups. Any new system that joins a **dynamic group** and matches its criteria gets encrypted automatically under the deployed policy, with no manual step required. More on [configuring custom groups](https://www.manageengine.com/desktop-management-msp/help/configuring_desktop_central/creating_custom_groups.html).

## Deploying the policy

Pick a target group, attach one policy to it, and deploy.

### Associate and deploy a policy

1. Go to **Policy Deployment** under the BitLocker Management module in the Endpoint Central MSP web console.
2. Click **Associate Policy**.

![Associate Policy button in the BitLocker Policy Deployment section.](https://www.manageengine.com/products/desktop-central/images/bitlocker-policy-deployment.png)

Starting policy association.

3. Select the custom group to deploy the policy to. To automate deployment for every new device, select **All Computers Group** — new computers join this group automatically, so they're encrypted automatically too.

![Selecting the All Computers Group to automate BitLocker deployment.](https://www.manageengine.com/products/desktop-central/images/bitlocker-automatic-encryption-select-custom-group.png)

Selecting a target group for automatic deployment.

4. Choose the BitLocker policy to associate with the group (only **one policy per group** is allowed).

![Selecting a BitLocker policy to associate with the target group.](https://www.manageengine.com/products/desktop-central/images/bitlocker-automatic-encryption-select-policy.png)

Selecting the policy to associate.

5. Click **Deploy**.

**Note:** A deployed policy applies on the next refresh cycle (90 minutes) unless you choose **Deploy Immediately**, which applies it right away — but Deploy Immediately is capped at 200 computers.

## Confirming devices actually encrypted

Deployment status and encryption status are two different things to check.

### Checking deployment and encryption status

After deployment, the associated-computers list shows each device's policy deployment status, along with remarks or reasons for any failures. Confirm encryption is either in progress or complete — a successful deployment doesn't by itself guarantee a device is encrypted.

![Managed Computers section showing encryption status per machine.](https://www.manageengine.com/products/desktop-central/images/bitlocker-managed-computers.png)

Checking encryption status in Managed Computers.

A machine can stay fully decrypted even after a successful deployment for two common reasons: the policy needs a user-entered PIN or passphrase, or it's a non-TPM machine where a passphrase is mandatory. Environmental issues can also cause failures — check [encryption prerequisites](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-pre-requisites.html) for machines blocked by BIOS mode incompatibility, WMI failures, or TPM ownership issues, each documented with remediation steps.

## Password requirements before encryption starts

Encryption only begins once a compliant password has been set — the rules differ by authentication type.

### Password criteria by authentication type

| Authentication type | Length | Complexity |
|---|---|---|
| TPM and PIN | 6—20 characters | Digits only; no continuous sequence of 3+ digits (e.g. 123, 789); no repetitive 2-character sequence (e.g. 1212, 2222) |
| TPM and Enhanced PIN | 6—20 characters | At least 1 uppercase, 1 lowercase, 1 digit, 1 special character; no continuous sequence of 3+ characters, case-insensitive (e.g. 123, abc, xYz); no repetitive 2-character sequence, case-insensitive (e.g. 1212, abab) |
| Passphrase | 8—255 characters | At least 1 uppercase, 1 lowercase, 1 digit, 1 special character; no continuous sequence of 3+ characters, case-insensitive; no repetitive 2-character sequence, case-insensitive |

![TPM and PIN password creation screen.](https://www.manageengine.com/products/desktop-central/help/images/bitlocker-password.png)

TPM+PIN password creation.

![Encryption process running on a device after a password is set.](https://www.manageengine.com/products/desktop-central/help/images/encryption-process.png)

Encryption in progress.

**Note:** Once a device is encrypted, its password has to be entered on every boot.

![BitLocker login prompt shown at boot on an encrypted device.](https://www.manageengine.com/products/desktop-central/help/images/bitlocker-login-prompt.png)

The BitLocker login prompt at boot.

## Related

- [BitLocker Policy Creation](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-policy-creation.html)
- [Configuring Custom Groups](https://www.manageengine.com/desktop-management-msp/help/configuring_desktop_central/creating_custom_groups.html)
- [BitLocker Encryption Prerequisites](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-pre-requisites.html)
- [BitLocker FAQ](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-faq.html#deployfaq)