How to enable or disable FileVault disk encryption?
Sign in to the Microsoft Endpoint Manager admin center. Select Endpoint security > Disk encryption > Create Policy. On the Basics page, enter the following properties, and then choose Next. Set Enable FileVault to Yes. For Recovery key type, only Personal Recovery Key is supported. Configure additional settings to meet your requirements.
Do you need user approved device for FileVault?
User-approved device enrollment is required for FileVault to work on a device. The user must manually approve of the management profile from system preferences for enrollment to be considered user-approved. To manage FileVault in Intune, your account must have the applicable Intune role-based access control (RBAC) permissions.
How to enable Intune to take over management of FileVault?
There are two methods you can use that enable Intune to take-over management of FileVault in this scenario: Upload a personal recovery key to Intune – Use this method when the user knows their personal recovery key. The user generates a new recovery key on the device – Use this method if the personal recovery key isn’t known by the user.
What happens if FileVault key rotation does not work?
If the key rotation is successful, Intune stores the new key for future use, and makes the key available to the user should the user need to recover their device. If the key rotation fails, then either the device hasn’t processed the FileVault policy, or the key that is entered isn’t accurate for the device.
Where can I find Recovery Key for FileVault 2?
For FileVault 2, you can extract the recovery key from Apple iCloud (you’ll need Elcomsoft Phone Breaker to do that). The original release of EFDD was made to scan the computer’s volatile memory image. In that image, the tool looks for cryptographic keys that are used for accessing data stored in encrypted containers.
How to encrypt a device with Intune FileVault?
The encrypted device must have an Intune FileVault policy for disk encryption. Before Intune can assume management of encryption of a user-encrypted device, that device must receive an Intune FileVault policy for disk encryption.