Glossary
BitLocker
Also called: BitLocker Drive Encryption
In one sentence
Microsoft’s full-disk encryption built into business editions of Windows, which makes a lost or stolen PC’s data unreadable.
BitLocker encrypts the entire drive of a Windows computer. It’s included in Windows 10 and 11 Pro, Enterprise and Education editions; Windows Home doesn’t include full BitLocker management (some Home devices have a simpler “device encryption” feature instead). That’s one reason business PCs should run a Pro or higher edition.
BitLocker normally works with the PC’s TPM chip, which stores the key securely and checks the computer hasn’t been tampered with before unlocking. To the user it’s invisible — they sign in as usual. To a thief who removes the drive or boots from a USB stick, the data is unreadable.
The critical detail is the recovery key. If a motherboard is replaced, a BIOS update goes wrong or the TPM detects a change, BitLocker asks for a 48-digit recovery key. If nobody saved it, the data is gone. With Intune, BitLocker can be switched on automatically and the recovery key stored safely in Entra ID, where your IT provider can retrieve it.
Example: a practice manager’s laptop is left in a restaurant. Because BitLocker was enforced by policy, the practice can show the drive was encrypted — an important point for HIPAA encryption at rest and breach assessment. Learn more in our Intune guide or see device management.
Related terms
- Encryption at restScrambling stored data — on laptops, servers, phones or in the cloud — so it’s unreadable to anyone without the key.
- TPM (Trusted Platform Module)A security chip (or chip-level feature) in a computer that stores encryption keys and checks the computer hasn’t been tampered with.
- Microsoft IntuneMicrosoft Intune is Microsoft's cloud service for managing and securing company computers, phones and tablets — settings, apps, updates and encryption — from one place.
- EndpointAny device that connects to your network or data — laptops, desktops, phones, tablets and servers — and is used by a person or runs business software.
- Microsoft Entra IDMicrosoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud identity service — the system that holds your users' accounts and controls how they sign in to Microsoft 365 and other apps.