Set the Autopilot BitLocker algorithm before automatic encryption begins

Source facts

BitLocker selects its encryption algorithm when encryption is first enabled; a device encrypted before receiving the intended settings must be decrypted to change that algorithm. Microsoft directs administrators to assign the BitLocker policy to an Autopilot device group and enable an Enrollment Status Page so that policy arrives before automatic encryption. Without that page, Microsoft states that the policy does not apply before encryption starts. Microsoft Learn.

Applicability

Apply this check to Windows Autopilot provisioning where the approved encryption method differs from automatic defaults. Record the intended method for each drive type before preparing the deployment.

DSE recommendation

DSE recommends making encryption timing an explicit provisioning acceptance item. Put the intended algorithm and encryption type in the deployment specification, identify the device assignment, and confirm that the enrollment page is enabled before releasing hardware to setup. If an already encrypted pilot differs from the specification, stop and develop an approved recovery and re-encryption plan; do not improvise decryption during delivery.

Verification

Provision a representative approved test device from its intended starting state. Inspect the actual encryption method and type after setup, and compare them with the written specification. Retain the device identity, relevant policy assignment, and observed result. Investigate a mismatch before repeating the deployment across additional devices.

Official references

Microsoft Learn: Setting the BitLocker encryption algorithm for Windows Autopilot devices. Source reviewed September 17, 2026.