Name your policies so you can easily identify them later. Name: Enter a descriptive name for the policy. On the Basics page, enter the following properties: On the Create a profile page, set the following options, and then click Create: Select Devices > Configuration profiles > Create profile. Sign in to the Microsoft Intune admin center. To manage FileVault in Intune, your account must have the applicable Intune role-based access control (RBAC) permissions.įollowing are the FileVault permissions, which are part of the Remote tasks category, and the built-in RBAC roles that grant the permission:Ĭreate device configuration policy for FileVault The user must manually approve of the management profile from system preferences for enrollment to be considered user-approved. User-approved device enrollment is required for FileVault to work on a device. This scenario requires the device to receive FileVault policy from Intune, followed by the user uploading their personal recovery key to Intune. In addition to using Intune policy to encrypt a device with FileVault, you can deploy policy to a managed device to enable Intune to assume management of FileVault when the device was encrypted by the user. After the key is escrowed, the disk encryption can start.

First, the device is prepared to enable Intune to retrieve and back up the recovery key. Intune provides a built-in encryption report that presents details about the encryption status of devices, across all your managed devices.Īfter you create a policy to encrypt devices with FileVault, the policy is applied to devices in two stages. To manage BitLocker for Windows 10/11, see Manage BitLocker policy. View the FileVault settings that are available in endpoint protection profiles for device configuration policy. For more information about using a device configuration profile, see Create a device profile in Intune. FileVault settings are one of the available settings categories for macOS endpoint protection. View the FileVault settings that are available in profiles for disk encryption policy.ĭevice configuration profile for endpoint protection for macOS FileVault. The FileVault profile in Endpoint security is a focused group of settings that is dedicated to configuring FileVault. Use one of the following policy types to configure FileVault on your managed devices:Įndpoint security policy for macOS FileVault. You can use Intune to configure FileVault on devices that run macOS 10.13 or later. FileVault is a whole-disk encryption program that is included with macOS. Intune supports macOS FileVault disk encryption.

Where to get recovery key for mac