Why doesn’t Intune support forcing BitLocker PIN after deployment like MBAM did?

Question

Why doesn’t Intune support forcing BitLocker PIN after deployment like MBAM did?

Belan Marek 56

Hello,

We used MBAM for years because it had a unique feature: it could enforce TPM+PIN after a certain time or immediately after deployment. This was critical for our security policy.

Now that MBAM is deprecated and we are moving to Intune/ConfigMgr BitLocker Management, we noticed that Intune cannot force users to set a BitLocker PIN interactively after OS installation. The only options are:

Require TPM+PIN from the start (static policy).
No built-in mechanism to prompt the user later or enforce PIN rotation.

Questions:

Why doesn’t Intune have this functionality? Is there a roadmap for adding it?
What is the recommended way to achieve similar behavior now?
- GPO can require TPM+PIN, but it doesn’t prompt the user.
  - We can script it with Add-BitLockerKeyProtector -TpmAndPinProtector, but that feels like a workaround.

Has anyone implemented a clean solution for this in an Intune-managed environment? Any official guidance from Microsoft on replacing MBAM’s PIN enforcement feature?

Thanks!

Rahul Jindal 11,721 Reputation points

2025-12-03T11:32:02.73+00:00

This is by design and very much intentional. The rationale is that the Windows OS relies to use TPM backed protector as default. The startup PIN adds no additional cryptographic protection against most practical cloud-managed threat models therefore does not align with Modern Zero trust model
Belan Marek 56 Reputation points

2025-12-04T07:04:07.9233333+00:00

When some one stole NB, all data is decrypted when he turn it on. This is why PIN is there !!!
Mohammed Sajid 6 Reputation points

2025-12-04T10:00:15.0533333+00:00

Hi Belan,

Not natively as forcing a BitLocker Pin is note a native capability, built into Microsoft Intune. You can combine Intune config and PowerShell Script to possibly achieve this.

I have come across this blog post before that might offer you some insight.

https://localerror.com/intune/deploying-bitlocker-with-a-startup-pin-through-intune-and-powershell/
LeeW 6 Reputation points

2026-07-17T08:19:08.9766667+00:00

I totally disagree with Microsoft's stance on PIN startup for BitLocker.

The theory is that the drive is encrypted so you don't need a PIN. So if somebody steals a laptop or finds a lost laptop the drive is encrypted, great, until that person starts the laptop up, then the OS is available to try to force their way in.

Another issue is that the decryption key is stored on the drive, with a bit of kit and knowledge / the ability to follow an online tutorial, the encryption key can be retrieved and the dirve decrypted. At that point you only have your NTFS permissions to protect you.

Adding a startup PIN encrypts the decryption key so it can't be retrieved, anybody who gains access to that laptop cannot boot it up. If you combine this with a BIOS password and limit boot devices to HDD only the laptop is useless to the casual thief, you're probably never going to see the machine again but at least you have the warm fuzzy feeling that it's just a doorstop now.

1 answer

Your answer

Rahul Jindal 11,721 Reputation points

2025-12-03T11:32:02.73+00:00

This is by design and very much intentional. The rationale is that the Windows OS relies to use TPM backed protector as default. The startup PIN adds no additional cryptographic protection against most practical cloud-managed threat models therefore does not align with Modern Zero trust model
Belan Marek 56 Reputation points

2025-12-04T07:04:07.9233333+00:00

When some one stole NB, all data is decrypted when he turn it on. This is why PIN is there !!!
Mohammed Sajid 6 Reputation points

2025-12-04T10:00:15.0533333+00:00

Hi Belan,

Not natively as forcing a BitLocker Pin is note a native capability, built into Microsoft Intune. You can combine Intune config and PowerShell Script to possibly achieve this.

I have come across this blog post before that might offer you some insight.

https://localerror.com/intune/deploying-bitlocker-with-a-startup-pin-through-intune-and-powershell/
LeeW 6 Reputation points

2026-07-17T08:19:08.9766667+00:00

I totally disagree with Microsoft's stance on PIN startup for BitLocker.

The theory is that the drive is encrypted so you don't need a PIN. So if somebody steals a laptop or finds a lost laptop the drive is encrypted, great, until that person starts the laptop up, then the OS is available to try to force their way in.

Another issue is that the decryption key is stored on the drive, with a bit of kit and knowledge / the ability to follow an online tutorial, the encryption key can be retrieved and the dirve decrypted. At that point you only have your NTFS permissions to protect you.

Adding a startup PIN encrypts the decryption key so it can't be retrieved, anybody who gains access to that laptop cannot boot it up. If you combine this with a BIOS password and limit boot devices to HDD only the laptop is useless to the casual thief, you're probably never going to see the machine again but at least you have the warm fuzzy feeling that it's just a doorstop now.

Answer 1

Pavel yannara Mirochnitchenko 13,456 MVP

Indeed, that is by design that PIN query is not brought by Intune as GUI for end user. With UEFI and Secure Boot, having PIN is not so critical anymore as it was with Windows 7 and legacy boot layout. But I still would recommend PIN for workstations where you handle extra critical data or there are other special security requirements. But not in "business-as-usual" type of use scenario.

0 comments