BitLocker encrypts the contents of a Windows device's hard drive so that, without the correct decryption key, the data is unreadable. On an unencrypted device, anyone with physical access can remove the hard drive, boot from external media, or use forensic tools to read every file on the disk — regardless of Windows login passwords, which are trivially bypassed outside of the operating system.
Device loss and theft are among the most common causes of data breaches in organisations with distributed workforces. A laptop left in a taxi, stolen from a car, or taken from a co-working space represents a complete data exposure event if BitLocker isn't active. The data on that device — emails, documents, cached credentials, browser sessions, and local copies of cloud files — is accessible to whoever has the physical machine.
BitLocker managed through Intune with recovery keys escrowed to Entra ID is the standard for modern managed Windows environments. It is low-friction, transparent to users once configured, and provides compliance evidence that the device's data is protected at rest.
BitLocker is appropriate for virtually all Windows managed devices. Very limited exceptions:
In most managed environments, there is no good reason not to have BitLocker enabled. The performance impact on modern hardware is negligible and the deployment is fully automated through Intune.
After enforcing this control, review these related areas: