BitLocker

What is BitLocker?

BitLocker is Microsoft’s built-in disk encryption for Windows. It encrypts entire volumes (the system drive, data drives, removable media) transparently in the background. Access is only possible with:

• a correct TPM unlock at boot,
• a PIN (optionally in addition), or
• a recovery key (if the TPM fails or has been reset)

. For the user this is invisible — BitLocker runs transparently. Once the device is unlocked, work carries on as normal.

Why does BitLocker matter?

Without BitLocker, anyone with physical access to a device can remove the disk and read it on another machine. Every piece of data — documents, passwords, cached credentials — is then openly accessible. With BitLocker the disk is unreadable noise until it is unlocked.

Die 3 BitLocker-Modi

In practice TPM-only is the standard — easy to handle, good security. For high-security devices (management laptops, administrator workstations), additionally TPM + PIN.

Managing BitLocker in the enterprise

BitLocker cannot be managed by hand across hundreds of devices. There are three management options:

Managing recovery keys

If a user locks themselves out of BitLocker (a TPM fault, a Windows update problem, a hardware change), they need a Recovery-Key. These 48-digit numbers have to be stored centrally:

• Entra ID — recovery keys are stored in Entra automatically, and the help desk can view them in the portal
• Active Directory — stored in AD objects (on-premises)
• Azure Key Vault — for ultra-secure setups

BitLocker for AVD, Windows 365 and cloud VMs

The situation here is a little more nuanced:

Azure Managed Disks

Azure VMs — whether session hosts, Windows 365 or ordinary VMs — run on Azure Storage with server-side encryption. The disks are already encrypted at storage level immer — BitLocker at VM level is not strictly necessary for data-at-rest protection.

Windows 365

Cloud PCs are Azure VMs — the data is already encrypted. Adding BitLocker is possible but adds little for data at rest. It can still make sense for compliance requirements.

AVD Personal Hosts

The same as Windows 365 — the VMs sit on encrypted Azure Storage.

AVD Multi-Session Hosts

BitLocker is rarely used at session host level here — the hosts are ephemeral infrastructure built from gold images. Storage-level encryption (Azure Disk Encryption) is usually enough.

The conclusion for DaaS

• Physical devices (laptops): disk encryption counts as state of the art and is assumed in most security concepts
• Cloud-VMs / Cloud-PCs: Azure Storage encryption is enough for most scenarios; BitLocker optional for compliance

BitLocker, GDPR and ISO 27001

GDPR

The GDPR requires “appropriate technical and organisational measures” to protect personal data. If an unencrypted laptop is lost, a reportable data breach generally has to be assumed; the GDPR provides for fines of up to 4% of worldwide annual turnover. The assessment in an individual case rests with the competent supervisory authority.

With BitLocker enabled and documented, losing the device is not automatically a data breach — because the data remains effectively unreadable (unless the recovery keys were lost with it).

ISO 27001 Annex A

Controls A.8.24 (use of cryptography) and A.7.10 (storage media) require encryption. BitLocker on every device satisfies them.

NIS2

The NIS2 directive (in force in Germany since October 2024) requires affected organisations to take specific measures on Cybersecurity-Hygiene — disk encryption is one of the baseline measures.