Turning on the disk encryption control encrypts the drive on every targeted device and escrows the recovery key, so you can get back into a machine without depending on the person who used it. It covers macOS and Windows fully. Linux is a different story, and the difference matters before you promise anything.

Feature/Functionality

Overview

Mobile needs nothing from you: Apple and Android encrypt their devices themselves, and there is no setting to manage. The work is on the three desktop platforms, and only two of them can be fixed after the fact.

How to use — macOS

1. Turn on the disk encryption control and target the devices.
2. FileVault switches on.
3. Encryption takes effect after the next restart, not immediately.
4. The recovery key is escrowed within 24 hours of that restart.

The gap between "enabled" and "encrypted" is a restart, and the gap between "encrypted" and "you have the key" is up to a day. A Mac that shows as non-compliant the same afternoon you enabled the control is usually just waiting for the employee to reboot.

How to use — Windows

1. Turn on the control and target the devices.
2. BitLocker switches on.
3. No restart needed.
4. The key is stored as soon as encryption activates.

Windows is the straightforward one. If it does not encrypt, the edition is the first thing to check: Windows Home has no BitLocker.

Linux: it has to be done at installation

Linux has no way to encrypt a disk after the operating system is installed. Adding encryption later means a full reinstall. So on Linux the control does not enforce anything — it collects.

What the flow actually looks like:

1. The employee encrypts the disk with LUKS while installing the operating system. This is the step that cannot be recovered later.
2. Once the device is enrolled, the agent shows the employee a banner asking them to escrow the recovery key.
3. They click Create key and enter the LUKS passphrase they already set.
4. A new recovery passphrase is generated and stored on the server.

Note who does what: the escrow happens through the agent on the device, not from your side. You cannot trigger it for them.

How to use — change or switch off

Open the control from MDM > Controls to edit or disable it. Disabling stops enforcement; it does not decrypt anything. Devices already encrypted stay encrypted, which is almost always what you want, but it does mean switching the control off is not a way to undo it.

Tips and Best Practices

• Build the restart into the rollout on macOS. Announce it, give a deadline, and expect your compliance list to look bad for a day or two. It is not drift.
• Check Windows editions before you enable anything. Every Home device in the fleet is a disk encryption issue that no setting will close.
• On Linux, the conversation happens at imaging time, not at enrolment. Once the machine is built unencrypted, your only options are a reinstall or an exception.
• Verify the key arrived, not that the control is on. An encrypted disk with no escrowed key is worse than useless on the day someone leaves.
• Do not disable the control to clear an issue. The device stays encrypted and you lose the enforcement.

Troubleshooting and FAQ

Troubleshooting

A Mac shows the control applied but is not encrypted. It has not restarted. FileVault takes effect on the next boot.

A Mac is encrypted but there is no recovery key. Escrow can take up to 24 hours after that restart. If a full day has passed, check the device is syncing.

A Windows device will not encrypt. Almost always Windows Home, which has no BitLocker. Upgrade the edition or accept the exception.

A Linux device reports no recovery key. The employee has not used the banner on their device yet. It needs them and their existing LUKS passphrase — you cannot do it for them.

Encryption stayed on after disabling the control. Expected. Disabling stops enforcement, it does not reverse what is already done.

FAQ

1. Do we need to do anything on phones and tablets?
   No. Both platforms encrypt themselves and expose nothing to manage.
2. Can we encrypt a Linux machine that is already in use?
   Not without reinstalling the operating system. That is a Linux limitation, not a product one.
3. Where do the recovery keys live?
   Escrowed on the server, retrievable by an administrator without involving the employee.
4. Does enabling this interrupt anyone's work?
   On Windows, no. On macOS it needs one restart. On Linux the employee has to click through the escrow banner once.

Related Articles

• Platform support
• Compliance overview
• Set up MDM on Linux
• Wipe devices