Configure FileVault disk encryption on macOS devices

Platforms

macOS

Products

IntuneFileVaultCompany Portal

Result

Managed Macs are encrypted with FileVault and their recovery keys are escrowed in Intune

Overview

Turn on FileVault on managed Macs with Intune, escrow the recovery keys, and take over Macs that users already encrypted themselves.

FileVault encrypts the data on a Mac and uses the user's login password as the passphrase. FileVault 2, the current version, encrypts the entire startup volume (full-disk encryption) with XTS-AES-128 encryption and a 256-bit key to prevent unauthorized access.

Microsoft Intune can configure FileVault on Macs running macOS 10.13 or later. In 2021 there were two options with the same settings:

1. Endpoint security policy (Disk encryption)
2. Device configuration profile (Endpoint protection template, now deprecated)

After the policy reaches the Mac, FileVault is turned on when the user signs out or signs in, depending on your settings. Encryption runs in the background while the user works, and only while the Mac is awake and connected to power.

For Macs that users already encrypted themselves, Intune can take over FileVault management (for example, after the user generates a new recovery key), but only when a FileVault policy is assigned to the device.

Prerequisites

Before you start, check that you have the following.

Configuration

With the prerequisites in place, create one FileVault policy and assign it to your Macs.

Create the FileVault policy

In 2021 I used the Intune admin center (then endpoint.microsoft.com) with these settings, which were the same in the policy and the profile:

• Enable FileVault: Yes
• Recovery key type: Personal key
• Escrow location description of personal recovery key: a short message that tells users how to get their personal recovery key
• Personal recovery key rotation: 1 month

The other settings are optional but affect the user experience, for example whether the recovery key is shown to the user, or whether the prompt to turn on FileVault at sign-out is disabled.

I assigned the profile to all Intune-managed Macs through a dynamic device group in Microsoft Entra ID.

Update (October 2026): the macOS Endpoint protection template is deprecated and can't be used for new profiles. Create the policy under Endpoint security > Disk encryption > Create Policy with platform macOS and profile macOS FileVault (Enable: On, Use Recovery Key: Enabled, Recovery Key Rotation In Months, Location). Or use the Full Disk Encryption settings in the settings catalog, which can also force FileVault in Setup Assistant on macOS 14 and later, see Encrypt macOS devices with FileVault using Intune.

User Experience

Finally, compare what happens on a new Mac and on a Mac the user already encrypted.

I compare two Macs (both macOS 11.4) that receive the same FileVault profile: the first one was not encrypted (new or reset), the second one was already encrypted by the user.

Mac that was not encrypted

FileVault is turned off:

The user enrolls the Mac with the Company Portal app:

Then the user approves the management profile (user-approved enrollment), which FileVault needs:

Company Portal tells the user that the device must be encrypted:

Until the disk is encrypted, the device is in a grace period or not compliant, depending on your compliance policy:

The user signs out and back in to turn on FileVault:

Security & Privacy shows the encryption progress (Privacy & Security in System Settings on macOS 13 and later):

When encryption is finished, the device becomes compliant:

Mac that the user already encrypted

FileVault is turned on and a recovery key has been set:

The user generated the recovery key earlier and may or may not have saved it somewhere safe:

When the Mac becomes managed by Intune and receives the FileVault policy, the policy most likely fails with error -2016341106 (FileVault is already enabled by the user):

For Intune to take over the existing FileVault encryption, the user does one of these:

• Upload the existing recovery key on the Company Portal website
• Generate a new recovery key on the Mac

If the user doesn't remember the old recovery key, they generate a new one in Terminal, and Intune manages it from then on:

cd /Applications/Utilities
sudo fdesetup changerecovery -personal

Output (my key is masked):

Enter the user name:hmaslowski
Enter the password for user 'hmaslowski':
New personal recovery key = 'XXXX-XXXX-XXXX-XXXX-XXXX-XXXX'

Intune now manages FileVault on the Mac that was encrypted before. You can see the recovery key in the Intune admin center (only for corporate-owned Macs):

The user can get the key from the Company Portal website (portal.manage.microsoft.com):

The FileVault profile deployed successfully: