Data Encryption at Rest and in Transit: A Practical Checklist for BitLocker, Intune and Microsoft 365

The short version: For a small or mid-size company on Microsoft 365, "enough" means four things: every Windows laptop encrypted with BitLocker and its recovery key stored in Microsoft Entra ID, Microsoft 365's built-in encryption left on and understood, email to partners protected with TLS or message encryption where the content is sensitive, and backups that are encrypted with someone who can restore them. Everything beyond that is for specific risks.

This is for owners and IT leads who have been asked "is our data encrypted?" and want a checklist they can tick off, with the admin steps. After reading it you will know what Microsoft already encrypts for you, what you must switch on yourself, and how to prove each item.

Steps and facts were checked against Microsoft Learn on 28 October 2026.

At rest and in transit in one minute

1. Data at rest is stored data: files on a laptop, mail in a mailbox, documents in SharePoint and OneDrive, backup copies.
2. Data in transit is data moving: a mail being delivered, a file synced, a Teams meeting, a backup running.
3. Encryption protects against a specific thing. At rest, it protects against a lost laptop, a stolen disk or a decommissioned device. In transit, it protects against someone reading the connection. Microsoft Learn also notes that encryption by itself does not prevent content interception, so it sits inside a wider information protection plan with MFA, access control and backup.

Level 1: the baseline every company should have

Devices (at rest)

1. BitLocker on every Windows laptop and desktop. BitLocker encrypts whole volumes and protects data on lost, stolen or inappropriately decommissioned devices. It gives maximum protection with a TPM. It is supported on Windows Pro, Enterprise and Education editions.
2. Recovery keys stored in Microsoft Entra ID. For Microsoft Entra joined devices, the recovery key is backed up to Entra ID automatically with device encryption.
3. No local-account-only laptops. Microsoft Learn notes that a device using only local accounts stays unprotected even though its data is encrypted.
4. Phones and tablets: require a device PIN or passcode through your device management policy.

Microsoft 365 (at rest)

1. Leave the service encryption on. Microsoft Learn says Microsoft 365 data is encrypted at rest and in transit with TLS/SSL, IPsec and AES. Files and mail in the data centres are protected with BitLocker and the Distributed Key Manager.
2. Know that this protects Microsoft's disks, not a stolen password. Add MFA. See our guide to MFA in Microsoft 365.

In transit

1. Email between Microsoft 365 organisations is sent over TLS. Microsoft Learn says Exchange Online servers always encrypt connections to other Exchange Online servers with TLS 1.2.
2. Email to everyone else uses opportunistic TLS by default: Exchange Online tries the most secure TLS version, and sends without encryption if the recipient's system does not support TLS.
3. Legacy TLS is deprecated. TLS 1.0 and 1.1 are deprecated for Office 365, and Microsoft says it does not recommend unencrypted email transmission.
4. Teams messages use TLS and MTLS, and media traffic uses SRTP.

Backups

1. Encrypt backup data at rest and in transit, and keep the key or passphrase somewhere other than the machine being backed up. Azure Backup, for example, encrypts data at rest with 256-bit AES using platform-managed keys by default, and transfers data over HTTPS. Check your own backup product's documentation for the same two facts.
2. Test a restore every quarter. See our managed backup service and the comparison of managed backup vs backup software.

Level 2: when your data is more sensitive

1. Require TLS to named partners. Opportunistic TLS is sufficient for most businesses. For banking, medical or similar partners, Microsoft says you can require TLS using connectors. You need one connector for each direction. In the Exchange admin center, go to Mail flow > Connectors > Add a connector. For mail you send, set Connection from to Office 365 and Connection to to Partner Organization, then on the Security restrictions screen tick Always use Transport Layer Security (TLS) to secure the connection (recommended). Repeat with From: Partner organization and To: Office 365 for mail you receive. Your partner needs a valid certificate from a commercial certification authority.
2. Encrypt the message itself for sensitive content. TLS encrypts the connection, not the message. If you forward a message to an organisation that does not support TLS, it is not necessarily encrypted. Use Microsoft Purview Message Encryption, which works with Outlook.com, Gmail, Yahoo and other services, or S/MIME. Admins can create mail flow rules that encrypt messages automatically. Steps for users and admins are in our guide to sending encrypted email in Outlook.
3. Add a pre-boot PIN on high-risk laptops. BitLocker can require a PIN or startup key. It cannot be used together with silent encryption, which needs no startup PIN.
4. Rotate recovery keys after use. Intune has a BitLocker key rotation remote action for Windows 10 version 1909 or later and Windows 11.

Level 3: only for specific requirements

Microsoft Learn lists Customer Key and Double Key Encryption among the encryption solutions you manage and control, built on Azure, and Personal Data Encryption adds file-level encryption on Windows 11 22H2 or later with Windows Hello for Business. Take them on only when a customer, regulator or risk assessment asks, and check licensing on Microsoft's pages first.

Enforce BitLocker with Intune

Check that devices are Microsoft Entra joined or hybrid joined, have TPM 1.2 or later, UEFI with Secure Boot enabled, and Windows Recovery Environment working.

1. Sign in to the Microsoft Intune admin center.
2. Go to Endpoint security > Disk encryption > Create Policy.
3. Choose Platform: Windows and Profile: BitLocker.
4. On Configuration settings, set encryption methods for the OS, fixed and removable drives, the recovery options, and TPM startup authentication.
5. For silent encryption, set Require Device Encryption to Enabled and Allow Warning For Other Disk Encryption to Disabled. Then set Allow Standard User Encryption to Enabled if staff are standard users. Under Operating System Drives, set Require additional authentication at startup to Enabled, then set Configure TPM startup PIN to Do not allow startup PIN with TPM, Configure TPM startup key to Do not allow startup key with TPM, Configure TPM startup key and PIN to Do not allow startup key and PIN with TPM, and Configure TPM startup to Allow TPM or Require TPM.
6. Assign the profile to a pilot group, then to all Windows devices.

Before silent rollout, find any third-party disk encryption already installed. Disabling the warning lets BitLocker proceed, which can cause data loss or boot failures if two products encrypt the same disk. Also review security baselines, because the Security baseline for Microsoft Defender can enable a TPM startup PIN and block silent encryption.

Common mistakes

1. Turning on BitLocker without escrowing recovery keys. Without the key, a hardware change can lock staff out.
2. Silent encryption over third-party encryption. Inventory first.
3. Assuming TLS means the email is encrypted end to end. TLS protects the connection only.
4. Deleting a device record in Intune before the laptop is retired. Deleting the Intune object of a Microsoft Entra joined, BitLocker-protected device removes the key protectors on the OS volume and leaves BitLocker suspended.
5. Giving everyone access to recovery keys. Reading a key needs a role such as Cloud Device Administrator or Helpdesk Administrator, and each read is audited. Keep that group small.
6. Backups encrypted, key lost. Store backup passphrases and keys in a vault with two people who can reach it.

How to check it worked

1. In the Intune admin center, go to Devices > Monitor > Encryption report and confirm every Windows device shows as encrypted.
2. Open one device: Devices > All devices > select the device > Monitor > Recovery keys, and confirm a BitLocker key ID exists.
3. On a laptop, run the command below in an elevated prompt and read the Conversion Status line.
4. Send a test email to an external address and confirm the message encryption rule applies, then open it as the recipient.
5. Restore one file from backup and record the time it takes.

manage-bde -status c:

FAQ

What is data encryption?

It converts readable data into ciphertext that can only be read with a key. Only people or systems holding the key can decrypt it.

What are the different types of encryption methods?

Symmetric encryption uses one key to encrypt and decrypt, and is used for stored data and bulk traffic. Asymmetric encryption uses a key pair and is used to exchange keys and prove identity. Real systems combine them, as TLS does.

What is the difference between encryption at rest and in transit?

At rest protects stored data, for example a laptop disk with BitLocker. In transit protects data on the move, for example TLS on an email connection.

What are some examples of data encryption?

BitLocker on a laptop disk (at rest), TLS on the connection between mail servers (in transit), Microsoft Purview Message Encryption on a single email, and an encrypted backup vault.

What is encryption and decryption?

Encryption turns readable data into ciphertext using a key. Decryption turns it back using the right key. A BitLocker-protected laptop disk, for example, cannot be read without the key or the unlock from the device's TPM.

For endpoint protection that includes encryption enforcement, see our managed endpoint security protection.