IntuneDiskEncryptionWindows10¶
Parameters¶
Parameter | Attribute | DataType | Description | Allowed Values |
---|---|---|---|---|
Description | Write | String | Policy description | |
DisplayName | Key | String | Policy name | |
RoleScopeTagIds | Write | StringArray[] | List of Scope Tags for this Entity instance. | |
Id | Write | String | The unique identifier for an entity. Read-only. | |
RequireDeviceEncryption | Write | String | Require Device Encryption (0: Disabled, 1: Enabled) | 0 , 1 |
EncryptionMethodWithXts_Name | Write | String | Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later) (0: Disabled, 1: Enabled) | 0 , 1 |
EncryptionMethodWithXtsOsDropDown_Name | Write | String | Select the encryption method for operating system drives: (3: AES-CBC 128-bit, 4: AES-CBC 256-bit, 6: XTS-AES 128-bit (default), 7: XTS-AES 256-bit) | 3 , 4 , 6 , 7 |
EncryptionMethodWithXtsFdvDropDown_Name | Write | String | Select the encryption method for fixed data drives: (3: AES-CBC 128-bit, 4: AES-CBC 256-bit, 6: XTS-AES 128-bit (default), 7: XTS-AES 256-bit) | 3 , 4 , 6 , 7 |
EncryptionMethodWithXtsRdvDropDown_Name | Write | String | Select the encryption method for removable data drives: (3: AES-CBC 128-bit (default), 4: AES-CBC 256-bit, 6: XTS-AES 128-bit, 7: XTS-AES 256-bit) | 3 , 4 , 6 , 7 |
IdentificationField_Name | Write | String | Provide the unique identifiers for your organization (0: Disabled, 1: Enabled) | 0 , 1 |
IdentificationField | Write | String | BitLocker identification field: (Device) | |
SecIdentificationField | Write | String | Allowed BitLocker identification field: (Device) | |
AllowWarningForOtherDiskEncryption | Write | String | Allow Warning For Other Disk Encryption (0: Disabled, 1: Enabled) | 0 , 1 |
AllowStandardUserEncryption | Write | String | Allow Standard User Encryption (0: This is the default, when the policy is not set. If current logged on user is a standard user, 'RequireDeviceEncryption' policy will not try to enable encryption on any drive., 1: 'RequireDeviceEncryption' policy will try to enable encryption on all fixed drives even if a current logged in user is standard user.) | 0 , 1 |
ConfigureRecoveryPasswordRotation | Write | String | Configure Recovery Password Rotation (0: Refresh off (default), 1: Refresh on for Azure AD-joined devices, 2: Refresh on for both Azure AD-joined and hybrid-joined devices) | 0 , 1 , 2 |
OSEncryptionType_Name | Write | String | Enforce drive encryption type on operating system drives (0: Disabled, 1: Enabled) | 0 , 1 |
OSEncryptionTypeDropDown_Name | Write | String | Select the encryption type: (Device) (0: Allow user to choose (default), 1: Full encryption, 2: Used Space Only encryption) | 0 , 1 , 2 |
ConfigureAdvancedStartup_Name | Write | String | Require additional authentication at startup (0: Disabled, 1: Enabled) | 0 , 1 |
ConfigureTPMStartupKeyUsageDropDown_Name | Write | String | Configure TPM startup key: (2: Allow startup key with TPM, 1: Require startup key with TPM, 0: Do not allow startup key with TPM) | 2 , 1 , 0 |
ConfigureTPMPINKeyUsageDropDown_Name | Write | String | Configure TPM startup key and PIN: (2: Allow startup key and PIN with TPM, 1: Require startup key and PIN with TPM, 0: Do not allow startup key and PIN with TPM) | 2 , 1 , 0 |
ConfigureTPMUsageDropDown_Name | Write | String | Configure TPM startup: (2: Allow TPM, 1: Require TPM, 0: Do not allow TPM) | 2 , 1 , 0 |
ConfigureNonTPMStartupKeyUsage_Name | Write | String | Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive) (0: False, 1: True) | 0 , 1 |
ConfigurePINUsageDropDown_Name | Write | String | Configure TPM startup PIN: (2: Allow startup PIN with TPM, 1: Require startup PIN with TPM, 0: Do not allow startup PIN with TPM) | 2 , 1 , 0 |
MinimumPINLength_Name | Write | String | Configure minimum PIN length for startup (0: Disabled, 1: Enabled) | 0 , 1 |
MinPINLength | Write | SInt32 | Minimum characters: | |
EnhancedPIN_Name | Write | String | Allow enhanced PINs for startup (0: Disabled, 1: Enabled) | 0 , 1 |
DisallowStandardUsersCanChangePIN_Name | Write | String | Disallow standard users from changing the PIN or password (0: Disabled, 1: Enabled) | 0 , 1 |
EnablePreBootPinExceptionOnDECapableDevice_Name | Write | String | Allow devices compliant with InstantGo or HSTI to opt out of pre-boot PIN. (0: Disabled, 1: Enabled) | 0 , 1 |
EnablePrebootInputProtectorsOnSlates_Name | Write | String | Enable use of BitLocker authentication requiring preboot keyboard input on slates (0: Disabled, 1: Enabled) | 0 , 1 |
OSRecoveryUsage_Name | Write | String | Choose how BitLocker-protected operating system drives can be recovered (0: Disabled, 1: Enabled) | 0 , 1 |
OSRequireActiveDirectoryBackup_Name | Write | String | Do not enable BitLocker until recovery information is stored to AD DS for operating system drives (0: False, 1: True) | 0 , 1 |
OSActiveDirectoryBackup_Name | Write | String | Save BitLocker recovery information to AD DS for operating system drives (0: False, 1: True) | 0 , 1 |
OSRecoveryPasswordUsageDropDown_Name | Write | String | Configure user storage of BitLocker recovery information: (2: Allow 48-digit recovery password, 1: Require 48-digit recovery password, 0: Do not allow 48-digit recovery password) | 2 , 1 , 0 |
OSHideRecoveryPage_Name | Write | String | Omit recovery options from the BitLocker setup wizard (0: False, 1: True) | 0 , 1 |
OSAllowDRA_Name | Write | String | Allow data recovery agent (0: False, 1: True) | 0 , 1 |
OSRecoveryKeyUsageDropDown_Name | Write | String | Configure OS recovery key usage: (2: Allow 256-bit recovery key, 1: Require 256-bit recovery key, 0: Do not allow 256-bit recovery key) | 2 , 1 , 0 |
OSActiveDirectoryBackupDropDown_Name | Write | String | Configure storage of BitLocker recovery information to AD DS: (1: Store recovery passwords and key packages, 2: Store recovery passwords only) | 1 , 2 |
PrebootRecoveryInfo_Name | Write | String | Configure pre-boot recovery message and URL (0: Disabled, 1: Enabled) | 0 , 1 |
PrebootRecoveryInfoDropDown_Name | Write | String | Select an option for the pre-boot recovery message: (0: , 1: Use default recovery message and URL, 2: Use custom recovery message, 3: Use custom recovery URL) | 0 , 1 , 2 , 3 |
RecoveryUrl_Input | Write | String | Custom recovery URL option: | |
RecoveryMessage_Input | Write | String | Custom recovery message option: | |
FDVEncryptionType_Name | Write | String | Enforce drive encryption type on fixed data drives (0: Disabled, 1: Enabled) | 0 , 1 |
FDVEncryptionTypeDropDown_Name | Write | String | Select the encryption type: (Device) (0: Allow user to choose (default), 1: Full encryption, 2: Used Space Only encryption) | 0 , 1 , 2 |
FDVRecoveryUsage_Name | Write | String | Choose how BitLocker-protected fixed drives can be recovered (0: Disabled, 1: Enabled) | 0 , 1 |
FDVActiveDirectoryBackup_Name | Write | String | Save BitLocker recovery information to AD DS for fixed data drives (0: False, 1: True) | 0 , 1 |
FDVHideRecoveryPage_Name | Write | String | Omit recovery options from the BitLocker setup wizard (0: False, 1: True) | 0 , 1 |
FDVRecoveryPasswordUsageDropDown_Name | Write | String | Configure user storage of BitLocker recovery information: (2: Allow 48-digit recovery password, 1: Require 48-digit recovery password, 0: Do not allow 48-digit recovery password) | 2 , 1 , 0 |
FDVRequireActiveDirectoryBackup_Name | Write | String | Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives (0: False, 1: True) | 0 , 1 |
FDVAllowDRA_Name | Write | String | Allow data recovery agent (0: False, 1: True) | 0 , 1 |
FDVActiveDirectoryBackupDropDown_Name | Write | String | Configure storage of BitLocker recovery information to AD DS: (1: Backup recovery passwords and key packages, 2: Backup recovery passwords only) | 1 , 2 |
FDVRecoveryKeyUsageDropDown_Name | Write | String | Select the fixed drive recovery key usage: (2: Allow 256-bit recovery key, 1: Require 256-bit recovery key, 0: Do not allow 256-bit recovery key) | 2 , 1 , 0 |
FDVDenyWriteAccess_Name | Write | String | Deny write access to fixed drives not protected by BitLocker (0: Disabled, 1: Enabled) | 0 , 1 |
RDVConfigureBDE | Write | String | Control use of BitLocker on removable drives (0: Disabled, 1: Enabled) | 0 , 1 |
RDVAllowBDE_Name | Write | String | Allow users to apply BitLocker protection on removable data drives (Device) (0: False, 1: True) | 0 , 1 |
RDVEncryptionType_Name | Write | String | Enforce drive encryption type on removable data drives (0: Disabled, 1: Enabled) | 0 , 1 |
RDVEncryptionTypeDropDown_Name | Write | String | Select the encryption type: (Device) (0: Allow user to choose (default), 1: Full encryption, 2: Used Space Only encryption) | 0 , 1 , 2 |
RDVDisableBDE_Name | Write | String | Allow users to suspend and decrypt BitLocker protection on removable data drives (Device) (0: False, 1: True) | 0 , 1 |
RDVDenyWriteAccess_Name | Write | String | Deny write access to removable drives not protected by BitLocker (0: Disabled, 1: Enabled) | 0 , 1 |
RDVCrossOrg | Write | String | Do not allow write access to devices configured in another organization (0: False, 1: True) | 0 , 1 |
Assignments | Write | MSFT_DeviceManagementConfigurationPolicyAssignments[] | Represents the assignment to the Intune policy. | |
Ensure | Write | String | Present ensures the policy exists, absent ensures it is removed. | Present , Absent |
Credential | Write | PSCredential | Credentials of the Admin | |
ApplicationId | Write | String | Id of the Azure Active Directory application to authenticate with. | |
TenantId | Write | String | Id of the Azure Active Directory tenant used for authentication. | |
ApplicationSecret | Write | PSCredential | Secret of the Azure Active Directory tenant used for authentication. | |
CertificateThumbprint | Write | String | Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication. | |
ManagedIdentity | Write | Boolean | Managed ID being used for authentication. | |
AccessTokens | Write | StringArray[] | Access token used for authentication. |
MSFT_DeviceManagementConfigurationPolicyAssignments¶
Parameters¶
Parameter | Attribute | DataType | Description | Allowed Values |
---|---|---|---|---|
dataType | Write | String | The type of the target assignment. | #microsoft.graph.groupAssignmentTarget , #microsoft.graph.allLicensedUsersAssignmentTarget , #microsoft.graph.allDevicesAssignmentTarget , #microsoft.graph.exclusionGroupAssignmentTarget , #microsoft.graph.configurationManagerCollectionAssignmentTarget |
deviceAndAppManagementAssignmentFilterType | Write | String | The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude. | none , include , exclude |
deviceAndAppManagementAssignmentFilterId | Write | String | The Id of the filter for the target assignment. | |
groupId | Write | String | The group Id that is the target of the assignment. | |
groupDisplayName | Write | String | The group Display Name that is the target of the assignment. | |
collectionId | Write | String | The collection Id that is the target of the assignment.(ConfigMgr) |
Description¶
Intune Disk Encryption for Windows10
Permissions¶
Microsoft Graph¶
To authenticate with the Microsoft Graph API, this resource required the following permissions:
Delegated permissions¶
-
Read
- DeviceManagementConfiguration.Read.All
-
Update
- DeviceManagementConfiguration.ReadWrite.All
Application permissions¶
-
Read
- DeviceManagementConfiguration.Read.All
-
Update
- DeviceManagementConfiguration.ReadWrite.All
Examples¶
Example 1¶
This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.
Configuration Example
{
param(
[Parameter()]
[System.String]
$ApplicationId,
[Parameter()]
[System.String]
$TenantId,
[Parameter()]
[System.String]
$CertificateThumbprint
)
Import-DscResource -ModuleName Microsoft365DSC
Node localhost
{
IntuneDiskEncryptionWindows10 'myDiskEncryption'
{
DisplayName = 'Disk Encryption'
Assignments = @(
MSFT_DeviceManagementConfigurationPolicyAssignments {
deviceAndAppManagementAssignmentFilterType = 'none'
dataType = '#microsoft.graph.allDevicesAssignmentTarget'
})
Description = ''
IdentificationField_Name = '1'
IdentificationField = 'IdentificationField'
SecIdentificationField = 'SecIdentificationField'
Ensure = 'Present'
ApplicationId = $ApplicationId;
TenantId = $TenantId;
CertificateThumbprint = $CertificateThumbprint;
}
}
}
Example 2¶
This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.
Configuration Example
{
param(
[Parameter()]
[System.String]
$ApplicationId,
[Parameter()]
[System.String]
$TenantId,
[Parameter()]
[System.String]
$CertificateThumbprint
)
Import-DscResource -ModuleName Microsoft365DSC
Node localhost
{
IntuneDiskEncryptionWindows10 'myDiskEncryption'
{
DisplayName = 'Disk Encryption'
Assignments = @(
MSFT_DeviceManagementConfigurationPolicyAssignments {
deviceAndAppManagementAssignmentFilterType = 'none'
dataType = '#microsoft.graph.allDevicesAssignmentTarget'
})
Description = ''
IdentificationField_Name = '1'
IdentificationField = 'IdentificationField'
SecIdentificationField = 'UpdatedSecIdentificationField' # Updated property
Ensure = 'Present'
ApplicationId = $ApplicationId;
TenantId = $TenantId;
CertificateThumbprint = $CertificateThumbprint;
}
}
}
Example 3¶
This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.
Configuration Example
{
param(
[Parameter()]
[System.String]
$ApplicationId,
[Parameter()]
[System.String]
$TenantId,
[Parameter()]
[System.String]
$CertificateThumbprint
)
Import-DscResource -ModuleName Microsoft365DSC
Node localhost
{
IntuneDiskEncryptionWindows10 'myDiskEncryption'
{
DisplayName = 'Disk Encryption'
Description = ''
Ensure = 'Absent'
ApplicationId = $ApplicationId;
TenantId = $TenantId;
CertificateThumbprint = $CertificateThumbprint;
}
}
}