Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To enforce Windows BitLocker without unnecessarily interrupting first sign-in, separate encryption provisioning from compliance evaluation. For a smoother enrollment experience, use Intune’s Require encryption of data storage on the device check in a dedicated Windows compliance policy and delay its noncompliance action for a measured period. Choose Require BitLocker instead when boot-time Device Health Attestation is the priority and a possible reboot is acceptable. A grace period delays an action; it does not make an unencrypted device compliant.
The original HTMD how-to was published on April 29, 2022. Its one-hour example remains a useful design pattern, but its older PowerShell commands should not be treated as a current, copy-and-run standard. The original article describes the enrollment problem; current Microsoft documentation clarifies the policy controls, action schedules, and Graph API.
Why BitLocker compliance can interrupt enrollment
On a newly enrolled Windows device, Intune enrollment and BitLocker encryption do not necessarily finish at the same time:
- Windows Autopilot or another enrollment path enrolls the device in Intune.
- A separate BitLocker configuration policy starts encryption and applies settings such as encryption method and recovery-key handling.
- The OS drive may still be encrypting when Intune evaluates compliance.
- If a compliance policy requires encryption and Conditional Access requires a compliant device, the user may be blocked before encryption finishes.
Microsoft notes that a device can remain noncompliant while encryption is unfinished; timing depends on factors such as the disk and BitLocker configuration. See Microsoft’s BitLocker compliance troubleshooting guidance.
#1 Best Overall
- Compact plug-and-stay design to instantly add storage to your laptop, game console, in-car audio, and more
- Save time with ultra-fast transfer speeds up to 400MB/s (Based on read speed. 1 MB/s = 1 million bytes per second. Based on internal testing; performance may vary depending upon host device, usage conditions, drive capacity, and other factors. USB 3.0 port required.)
- Transfer a full-length movie to the drive in less than 30 seconds (Based on 1.2GB MPEG-4 video transfer with USB 3.2 Gen 1 or USB 3.0 host device.)
- Get space for your high-resolution photos, videos, and more at a great value with up to 256GB of storage (1GB=1,000,000,000 bytes. Actual user storage less.)
- Password-protect files using a downloadable software (Password protection uses 128-bit AES encryption and is supported by Windows 10+ and macOS v10.9+ (Software download required, see Password Protection page on SanDisk site).)
This is a compliance-enforcement problem, not a way to turn on BitLocker. A compliance policy checks whether a condition is met. It does not replace the BitLocker configuration policy that provisions encryption.
Choose the right Intune compliance control
Windows compliance policies offer two relevant settings. Microsoft describes their different signals in its Windows compliance settings reference.
| Setting | What it checks | Trade-off |
|---|---|---|
| Require BitLocker | Uses Windows Device Health Attestation to evaluate BitLocker status at boot time. | Provides a health-attestation-based signal, but a reboot may be needed before Intune reports an updated result. Hardware and attestation prerequisites matter. |
| Require encryption of data storage on the device | Checks encryption at the OS-drive level; Microsoft says Intune currently supports BitLocker for this Windows check. | Fits a design that allows encryption to finish in the background, but the device can remain noncompliant until encryption completes. |
The choice is not simply “secure” versus “not secure.” Prefer Require BitLocker when the boot-time health signal is important and a reboot delay is acceptable. Consider storage encryption plus a short grace period when avoiding an enrollment interruption is more important and the organization accepts a temporary delay before blocking access. The HTMD article reports a favorable experience with the latter pattern, but device and tenant behavior should be tested rather than assumed.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat a grace period does—and does not do
Intune evaluates the compliance condition independently of the action schedule. By default, a policy has a Mark device noncompliant action scheduled at zero days. Changing that schedule delays the action; it does not convert a device that has not met the BitLocker condition into a compliant device. A blocking Conditional Access policy may restrict access once the relevant noncompliance action takes effect, but the result depends on assignments, sign-in state, device identity, and tenant configuration. Review Microsoft’s documentation on actions for noncompliance.
The Intune admin center supports decimal day values in 0.25-day increments. Examples are:
| Value | Duration |
|---|---|
0 |
Immediate |
0.25 |
6 hours |
0.5 |
12 hours |
0.75 |
18 hours |
1 |
24 hours |
A one-hour period is about 1/24 of a day (0.0416667 days), which is not one of the portal’s documented increments. Microsoft says other intervals can be configured through Graph. Do not assume the portal will accept a rounded value such as 0.04.
Design the policy before assigning it
If BitLocker needs a different remediation window from other controls, put the encryption requirement in a dedicated compliance policy. Avoid combining it with TPM, antivirus, firewall, or OS-version requirements when those checks should be enforced on a different schedule. Otherwise, delaying the action on the combined policy may delay enforcement of those unrelated requirements too.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Use a pilot assignment first. Decide whether users or devices are the appropriate target, identify intentional exclusions (for example, supported lab or break-glass scenarios), and check for overlapping policies with contradictory settings. A device must be enrolled in Intune and associated with the expected Entra device record; Conditional Access must evaluate the intended user and device.
Create the policy in the Intune admin center
- Go to Devices > Compliance policies in the Intune admin center and create a policy for Windows 10 and later.
- In the encryption-related settings, choose Require encryption of data storage on the device if you are adopting the grace-period design.
- Keep the policy focused on the encryption condition and save it for a pilot group.
- Open the policy’s Properties > Actions for noncompliance. Edit the default Mark device noncompliant action and set a tested interval, such as 0.25 days for six hours or 0.5 days for twelve hours.
- Save, assign the policy, and verify the resulting device status and sign-in behavior before broad deployment.
These portal values are convenient for six-hour and twelve-hour windows. For a finer interval such as one hour, use Graph or a currently supported automation method and verify the returned policy object.
Create or inspect the policy with Microsoft Graph
The Windows compliance-policy resource is microsoft.graph.windows10CompliancePolicy. Its storageRequireEncryption property represents the OS-drive encryption check; bitLockerEnabled is a distinct setting. See the Graph resource reference and create-operation documentation.
A minimal request body for the encryption check looks like this:
{
"@odata.type": "#microsoft.graph.windows10CompliancePolicy",
"displayName": "Windows - BitLocker encryption",
"description": "Require OS-drive encryption",
"storageRequireEncryption": true
}Send it to:
POST https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies
Content-Type: application/jsonThe body illustrates the compliance setting only; it does not provision BitLocker, set assignments, or define a noncompliance action schedule. Configure and verify those parts separately using the current Graph schema or Intune admin center. Microsoft documents DeviceManagementConfiguration.ReadWrite.All for creation. For read-only inspection, use DeviceManagementConfiguration.Read.All where possible; the more privileged read-write permission can also read. An active Intune license is required. Use least privilege, protect automation credentials, and avoid placing tokens in scripts. The Graph documentation also specifies supported cloud environments and does not support personal Microsoft accounts.
Rank #2
- Not for Microsoft accounts (e.g., @outlook.com logins)
- ✅ Compatible with most PCs, laptops, and desktops
- ✅ Finish in 10 minutes or less for most systems
- ✅ Step-by-step PDF instructions included
- ✅ Supports Windows 7, 8, 10, and some 11 systems (local accounts only)
The 2022 HTMD article shows older Intune PowerShell SDK commands such as Connect-MSGraph, New-IntuneDeviceCompliancePolicy, and New-DeviceComplianceScheduledActionForRuleObject. Treat that example as historical rather than assuming those commands or their parameters are the current supported approach. Check the current SDK, Graph schema, authentication method, permissions, and action-schedule representation before automating changes.
Inspect the policy and its schedule
To retrieve a policy and expand its assignments and scheduled actions, use the documented Graph GET operation. The query pattern below is also shown in the HTMD article:
GET https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies/{policy-id}?$expand=assignments,scheduledActionsForRule($expand=scheduledActionConfigurations)For current read-operation permissions and behavior, see Microsoft’s GET documentation. Check the returned policy ID, @odata.type, display name, storageRequireEncryption, whether bitLockerEnabled is also set, assignments, and the scheduled action configuration—including action type and grace-period value. Also look for duplicate or conflicting policies.
Recommended Free Tools
Test the complete path, including Conditional Access
Validate the whole chain rather than relying on a single “compliant” indicator:
- Provisioning: Confirm the BitLocker configuration policy is assigned, the device is compatible, encryption starts, and the recovery key is escrowed to the approved recovery-key system.
- Local state: In an elevated PowerShell session, check the OS volume:
Get-BitLockerVolume -MountPoint $env:SystemDrive | Select-Object MountPoint, VolumeStatus, EncryptionPercentage, ProtectionStatus, KeyProtectorUse
VolumeStatusandEncryptionPercentageas well asProtectionStatus; protection being on does not prove encryption is complete. - Intune evaluation: Sync the device from Windows Settings or Company Portal, then review its compliance status and per-setting report. Allow time for reporting. If the policy uses the boot-time health signal, test whether a restart is needed.
- Access decision: Test a new sign-in for a user covered by Conditional Access and review the Entra sign-in logs. Also test intended exclusions and confirm break-glass accounts are not accidentally blocked.
Include a freshly enrolled device, one already encrypted, one that encrypts slowly, and one with encryption deliberately paused or failing. Test a device that has not rebooted as well. Never assume that a device “in grace” will universally be allowed access: Conditional Access policy scope, session and token state, sign-in timing, and device identity all affect the result.
Troubleshoot by symptom
BitLocker is complete, but Intune still reports noncompliance
- Check which compliance setting is failing. If the policy uses Require BitLocker, a reboot may be necessary for a fresh boot-time Device Health Attestation result.
- Trigger an Intune sync and allow time for a new report.
- Confirm that you are viewing the expected Entra device object and that it has the right policy assignments.
- Check other assigned compliance policies: one failing policy or setting can keep the overall result noncompliant.
- Review the per-setting report and health-attestation status rather than attributing every failure to encryption.
The device is still encrypting
That can be expected with the storage-encryption check: the device may remain noncompliant until encryption completes. Check whether the encryption percentage is advancing and whether the volume is paused. Review relevant BitLocker and device-management events, sync with Intune, and recheck the per-setting report. Restart only when appropriate—particularly if the chosen control depends on a boot-time measurement.
Encryption outlasts the grace period
If the device remains noncompliant and the scheduled action blocks access, it can be blocked when the delay ends. Do not extend the window without investigating why encryption or reporting is slow. Compare device models, drive size, encryption method, used-space-only versus full-volume encryption, Autopilot timing, policy timing, and Intune check-in behavior across the affected fleet. One hour is an example to test, not a universal guarantee.
The portal will not accept a one-hour interval
The documented portal increments are 0.25 day, starting with six hours. Use Graph or a supported automation route for finer intervals, then inspect the stored action schedule to confirm the result.
Conditional Access blocks the user despite the expected schedule
Verify that the intended compliance policy and action schedule are assigned, the sign-in uses the expected device identity, and the user is in the intended Conditional Access scope. Inspect sign-in logs and test a fresh sign-in; an existing session or cached state can obscure a policy change. Confirm that exclusions and emergency-access accounts work as designed.
Set the window from evidence, not habit
A shorter delay limits the period before enforcement but increases the chance of blocking a user whose device is merely slow to encrypt or report. A longer delay improves the odds of uninterrupted enrollment but extends the time before a noncompliant device faces the configured action. Measure actual fleet behavior before selecting a window: drive sizes, device models, encryption settings, enrollment duration, check-in latency, and Conditional Access results.
The original HTMD author reported that one or two hours balanced usability and security in that deployment. That observation is not a Microsoft-wide timing guarantee. For sensitive resources, consider immediate enforcement or a shorter, tightly tested interval. If a short delay is justified, keep it limited to the BitLocker policy rather than letting unrelated requirements inherit it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
