BitLocker Management

Getting Started with BitLocker Management

Managing BitLocker encryption across an enterprise requires a structured approach to ensure security and compliance. Endpoint Central MSP simplifies this with automated policy deployment, real-time monitoring, and secure recovery key management.

• Granular BitLocker Policy Configuration — Administrators can create detailed encryption policies with options for TPM Only, TPM with PIN, Enhanced PIN, or Passphrase for non-TPM devices. Encryption methods include full drive encryption, OS drive encryption, or used space encryption for optimized performance, with several encryption algorithms to select.

  Moving from another BitLocker management tool? Review the migration checks before deploying a new policy. Existing encryption, protectors and recovery-password backup must be checked first.

• Automated Enforcement of Encryption Policies — Policies target eligible computers in the selected custom groups. Deploy schedules policy delivery for the next refresh cycle. Deploy Immediately requests delivery to online agents, subject to the documented 200-computer batch behavior. Neither option guarantees instant completed encryption. Review policy deployment and verification for the rollout checks. Automated Enforcement of Encryption Policies

• Encryption Status of Managed Computers — The Managed Computers section provides a centralized view of encryption status, showing which devices are encrypted, pending encryption, or non-compliant. Administrators can also view detailed encryption reports to track compliance, review encryption methods, and monitor device security.

  Note

  If Managed Computers stays blank or displays loading placeholders, follow Managed Computers display troubleshooting. A page-rendering failure is different from one computer being absent from a completed list.

• Deployment Prerequisite Checks for Error Prevention — The solution proactively detects BIOS mode incompatibility, TPM ownership errors, and other encryption failures before deployment, so administrators can address reported failures before deployment.

• Recovery Key Management — Secure recovery key management ensures that keys are automatically stored in Active Directory or the Endpoint Central MSP server, with backup options and retention policies to prevent data loss.

Licensing

BitLocker Management module is available in the Security Edition license or as a paid add-on to the other editions such as Professional, Enterprise, or UEM Edition. The add-on must be purchased separately from the base Endpoint Central MSP license. Pricing is based on the number of devices purchased.

Free Edition:Endpoint Central MSP's Free edition includes the BitLocker Management module for up to 25 devices at no additional cost. When the trial ends for an organization using Endpoint Central MSP Free Edition, BitLocker Management remains available under the Free Edition for up to 25 devices.

Check trial state and managed scope

The Endpoint Security add-on page can show activation information, license type and trial expiry. If your console offers a trial, check the expiry displayed for your account. After enablement, review managed-computer selection where the add-on uses limited scope. Activation and computer enrollment are separate checks.

If the BitLocker menu is unavailable, verify the add-on state and your BitLocker role before diagnosing policy delivery. The activation and managed-computer controls depend on the product and license state. Follow licensing and access guidance.

Check access and computer scope before deployment

Verify the license entitlement, assigned BitLocker role and technician computer scope. For a limited add-on, review managed computers under Admin → Global Settings → Endpoint Security, click Manage, and add the intended endpoints. Select the required computers or available static computer groups. Keep the number of newly selected computers within the available license capacity, then save the selection. Check that the refreshed managed-computer list includes the intended computers.
Then check component and reported drive status. Creating a deployment group does not independently grant add-on eligibility. See License Validation and BitLocker access roles.

Role-Based Access Controls

To ensure secure and controlled access, BitLocker Management provides role-based access control (RBAC) for IT teams. This allows administrators to grant restricted technician access specifically for BitLocker configuration and recovery key management without exposing other critical system configurations, while preventing unauthorized access to other system settings.