BitLocker vs Windows device encryption: what is the difference?

Device encryption is a Windows feature that turns BitLocker on automatically on devices that qualify, and backs up the recovery key to Microsoft Entra ID, Active Directory or a Microsoft account. Standard BitLocker is the full feature set you configure yourself. Both rely on the same encryption underneath.

What each one is

BitLocker encrypts entire volumes. Microsoft describes its purpose as addressing data theft or exposure from lost, stolen or inappropriately decommissioned devices. It gives its strongest protection with a Trusted Platform Module, and can add a startup PIN or a startup key on a removable drive.

Device encryption is the simple path. It is available on all Windows versions, it encrypts the OS drive and fixed drives (not external or USB drives), and it is enabled without the user doing anything. BitLocker enablement itself is available on Windows Pro, Enterprise, Pro Education/SE and Education.

Which devices qualify

Historically a device needed to meet Modern Standby or HSTI requirements and have no externally accessible DMA ports. Microsoft's page states that starting in Windows 11, version 24H2, those prerequisites were removed, so more devices are eligible.

You can check a device in System Information (msinfo32.exe). If it qualifies, the line Device Encryption Support reads Meets prerequisites.

The recovery key is the part people miss

Device encryption starts with a clear key, which is equivalent to BitLocker in a suspended state. The drive shows a warning icon until the TPM protector is created and the recovery key is backed up. What happens next depends on how the laptop is joined.

• Entra joined or Active Directory joined. The recovery key is backed up to Entra ID or AD DS, and then the clear key is removed.
• Not domain joined. A Microsoft account with administrator rights on the device is needed. On sign in, the recovery key is uploaded to that account.
• Local accounts only. The data is encrypted but the device remains unprotected, because the clear key stays in place.

That last case matters for contractors and for people who set up a personal laptop with a local account. The disk looks encrypted and is not meaningfully protected.

What to do as a team lead

1. Decide whether developer laptops are enrolled in your identity provider, so recovery keys land somewhere your team controls.
2. Check the encryption status of each laptop, not just the policy.
3. Keep device encryption on where it is supported. Microsoft recommends this.
4. Add a startup PIN for higher risk users if your threat model calls for it.

If someone changes the encryption method later, Microsoft notes the device must first be decrypted before a different method or cipher strength can be applied. Set policy before the first encryption, ideally.

See also do you need a TPM for BitLocker.

Quick check

Sources

• BitLocker overview, Microsoft Learn

Last reviewed: 19 October 2026.