# Set the Autopilot BitLocker algorithm before automatic encryption begins

> How can an Autopilot deployment apply the intended encryption algorithm before BitLocker starts?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-001-set-the-autopilot-bitlocker-algorithm-before-automatic-encryption-begins/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:59+00:00
- Modified: 2026-09-17T16:35:02+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

How can an Autopilot deployment apply the intended encryption algorithm before BitLocker starts?

## Potentially affected

Apply this check to Windows Autopilot provisioning where the approved encryption method differs from automatic defaults. Record the intended method for each drive type before preparing the deployment.

## DSE recommendation

DSE recommends making encryption timing an explicit provisioning acceptance item.

## Article

## Source facts

BitLocker selects its encryption algorithm when encryption is first enabled; a device encrypted before receiving the intended settings must be decrypted to change that algorithm. Microsoft directs administrators to assign the BitLocker policy to an Autopilot device group and enable an Enrollment Status Page so that policy arrives before automatic encryption. Without that page, Microsoft states that the policy does not apply before encryption starts. [Microsoft Learn](https://learn.microsoft.com/en-us/autopilot/bitlocker).

## Applicability

Apply this check to Windows Autopilot provisioning where the approved encryption method differs from automatic defaults. Record the intended method for each drive type before preparing the deployment.

## DSE recommendation

DSE recommends making encryption timing an explicit provisioning acceptance item. Put the intended algorithm and encryption type in the deployment specification, identify the device assignment, and confirm that the enrollment page is enabled before releasing hardware to setup. If an already encrypted pilot differs from the specification, stop and develop an approved recovery and re-encryption plan; do not improvise decryption during delivery.

## Verification

Provision a representative approved test device from its intended starting state. Inspect the actual encryption method and type after setup, and compare them with the written specification. Retain the device identity, relevant policy assignment, and observed result. Investigate a mismatch before repeating the deployment across additional devices.

## Official references

[Microsoft Learn: Setting the BitLocker encryption algorithm for Windows Autopilot devices](https://learn.microsoft.com/en-us/autopilot/bitlocker). Source reviewed September 17, 2026.

## Primary reference

- Name: Setting the BitLocker encryption algorithm for Windows Autopilot devices | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/autopilot/bitlocker
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Set the Autopilot BitLocker algorithm before automatic encryption begins,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-001-set-the-autopilot-bitlocker-algorithm-before-automatic-encryption-begins/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.