Turning On BitLocker and FileVault for the Whole Team

Why laptop encryption matters for a small business

A laptop password alone does not protect the data. Anyone with a screwdriver can remove an unencrypted drive and read it from another computer. Full-disk encryption scrambles everything on the drive so it is unreadable without the user's sign-in or a recovery key.

It also matters for compliance. Encrypted laptops are a standard control in CSA's Cyber Essentials mark (see our Cyber Essentials checklist), and the PDPC's guide to data protection practices for ICT systems (revised July 2026) says organisations should protect personal data on all computing devices and storage media with appropriate measures, including encryption, whether the devices are company-issued or staff-owned. If an encrypted laptop goes missing, the incident is far easier to contain.

Windows: BitLocker vs Device Encryption and edition rules

Which encryption a Windows laptop can use depends on its edition. Check under Settings > System > About.

Microsoft's BitLocker overview lists Pro, Enterprise, Pro Education/SE and Education as the editions that support BitLocker. Its Device Encryption page explains that Device Encryption, available on a wider range of devices including Windows Home, turns on automatically when someone signs in with a Microsoft account or a work account, and the recovery key is attached to that account.

Turn on BitLocker with Intune and save keys in Entra ID

For a team on Microsoft 365 Business Premium, Intune is included and is the cleanest way to encrypt every PC. Microsoft's Intune encryption guide covers both standard (user sees prompts) and silent encryption.

1. 1

   Join PCs to Microsoft Entra ID and enrol in Intune

   Silent BitLocker needs devices to be Entra joined or hybrid joined, with TPM 1.2 or later, native UEFI, Secure Boot and Windows Recovery Environment available.

2. 2

   Create a BitLocker policy in Endpoint security

   In the Intune admin centre, go to Endpoint security > Disk encryption and create a BitLocker profile. Microsoft notes the Settings Catalog lacks some TPM startup controls needed for reliable silent enablement.

3. 3

   Require key backup to Entra ID before encrypting

   Set the policy so the recovery key is saved to Entra ID and encryption does not start until the backup succeeds.

4. 4

   Choose encryption strength and scope

   XTS-AES 128-bit is the Windows default; encrypt the full OS drive and fixed data drives. Decide whether removable USB drives must be encrypted too.

5. 5

   Assign to a pilot group first

   Apply to two or three laptops, confirm they encrypt and the keys appear in Entra ID, then assign to all company devices.

Without Intune, you can still turn on BitLocker from Control Panel on each Pro laptop and save the recovery key to your work account or print it to a locked file. It works, but you will not have one report showing every device.

Macs: turning on FileVault through MDM

On a Mac with Apple silicon or a T2 chip, FileVault uses the hardware encryption built into the Mac. Users can turn it on in System Settings, but a business should do it through device management so the recovery key is captured.

Apple's guide to managing FileVault with device management explains that the MDM service can force FileVault on at the next login or logout, limit how many times a user can defer, decide whether the user sees the recovery key, and encrypt the personal recovery key for escrow to the MDM server. New Macs can be made to turn FileVault on during Setup Assistant.

• Use Apple Business Manager so new Macs enrol into MDM automatically when unboxed.
• Push a FileVault payload with recovery key escrow before or at first login.
• Hide the recovery key from users if your policy is that IT holds it.
• Intune, Jamf, Kandji, Mosyle and similar tools all support this; check the Mac appears as encrypted in the console.

Where to store BitLocker and FileVault recovery keys

The recovery key is the one thing that gets you back into an encrypted laptop after a forgotten password, a hardware change or a firmware update that triggers recovery. Lose it and the data is gone.

Microsoft's find your BitLocker recovery key page lists the places keys may be stored, including a personal Microsoft account and a work or school account. Make sure yours is the second.

How to check every laptop is actually encrypted

Policies fail quietly: an older PC without a working TPM, a Mac where the user keeps deferring, a laptop that was never enrolled. Check, do not assume.

When a laptop goes missing, this report is what lets you say the data was protected. Our guide to BYOD and MDM for small businesses explains how to handle staff-owned devices, which you usually cannot force to encrypt in the same way.

Do it yourself or get help?

A team of two or three on Windows Pro and Macs can switch encryption on manually in an afternoon. Write down where each key is saved and check it again whenever a laptop is replaced.

Beyond five or so devices, or with a mix of Windows and Mac, device management pays off. Our Device Encryption & Management package (S$490) enrols laptops in Intune or another MDM, turns on BitLocker and FileVault with central key escrow, and hands you the encryption report. When a laptop is eventually retired, follow our guide to disposing of old computers safely.