Introduction

Enforce disk encryption on managed devices without touching each one manually. This action enables BitLocker on Windows and FileVault on macOS, targeting the system drive or all drives depending on your configuration.

Enable Disk Encryption

To add this action to an empty automation, choose Add an action in the pipeline. In a populated automation, click the inline + where you want the step and choose Add another action. In the action picker, select Security, then Enable disk encryption. After the step is added, select it in the pipeline to open its configuration in the side panel.

an existing demo automation with an Enable disk encryption step already present and selected, showing its configuration in the side panel; do not add or edit a step, save changes, run the automation, or change any device

Disk Drive

🖥️ PLATFORM NOTE:

Windows: Uses full BitLocker management. On Windows 10 and 11, this requires Pro, Enterprise, or Education. Windows Server 2016, 2019, 2022, and 2025 are also supported. Windows Home is not supported by this action. Any drive targets all attached drives; System drive only targets the boot/OS drive.
macOS: Always treated as System drive only, regardless of which option is selected. Uses FileVault.
Linux: Not supported. This action is not implemented on Linux.

The Disk drive dropdown controls which drives Level targets for encryption.

Option	Behavior
Any drive	Enables encryption on all drives on the device. Windows only.
System drive only	Enables encryption on the OS drive only. Applies to Windows and macOS.

ℹ️ NOTE: If your automation targets a mixed-OS group that includes macOS devices, selecting Any drive won't cause an error — macOS devices will encrypt the system drive only regardless.

Windows Requirements

A usable TPM must be present, enabled, and ready. For a virtual machine, configure a guest-visible vTPM before running this action. When enabling BitLocker on the system drive, Level ensures a TPM protector and creates a numerical recovery-password protector, then stores the recovery password in Level.
On Windows Server, install the BitLocker Drive Encryption feature and its management tools, then complete the required restart during a maintenance window before running this action. If the BitLocker PowerShell module is missing, Level attempts to install the feature and management tools, but does not automatically restart the server. See Microsoft's Install BitLocker on Windows Server guide.

Conditions

The Conditions section lets you restrict when this action runs based on device attributes or the outcome of a previous action. Expand the section to add conditions.

See Action Conditions for the full reference on condition types, operators, and values.

Additional Options

Expand Additional options for additional execution settings including action name, failure behavior, output variables, and retries.

See Actions Overview for the full reference on additional options available on every action.

FAQ

Does this action work on Windows Home? No. Level uses the full BitLocker management tools available on Windows 10 and 11 Pro, Enterprise, and Education. Windows Home's Device Encryption feature uses BitLocker technology, but it is a separate Windows feature and this action does not turn it on.
Where is the Windows recovery key stored? Level stores the recovery key securely and shows it under Device Overview → Disk → View encryption keys. Level does not send the key to a Microsoft account, Microsoft Entra ID, or Active Directory Domain Services. Windows, device-management policy, or another administrator may independently back up other BitLocker or Device Encryption keys outside Level.
What happens to existing BitLocker recovery-password protectors? Before creating and storing its managed recovery key, Level removes existing numerical recovery-password protectors from the targeted drive. Record any recovery keys you need before running this action. A key that was backed up elsewhere may no longer unlock the drive after its protector is replaced.
Does this action work on Linux? No. Disk encryption is not implemented for Linux. If your automation targets a mixed-OS group, only Windows and macOS devices will execute this step.
What encryption method does Level use on each platform? BitLocker on Windows and FileVault on macOS. Level invokes the OS-native encryption tool — it doesn't install third-party encryption software.
Why is "Any drive" labeled Windows only? macOS always encrypts the system drive only, regardless of which option is selected. The Any drive option has no additional effect on macOS.
What happens if encryption is already enabled on the device? Level skips the drive and moves on — no error, no duplicate operation. If the drive is fully protected or encryption is already in progress, Level logs the status and returns success. For multi-drive targets, it skips already-encrypted drives and enables encryption only on the ones that need it.
Will enabling encryption require a reboot? BitLocker enablement uses -SkipHardwareTest to bypass the hardware test that normally requires a reboot. Installing the BitLocker feature on Windows Server requires a restart, and TPM initialization may also require one. Complete these prerequisite restarts before running the action. Level does not automatically restart the device. Level also uses -UsedSpaceOnly, so only the used portion of the disk is encrypted, which makes the process faster.
What happens if the device is offline when the action runs? The action queues and resumes once the device comes back online.
Who can add or modify this action in an automation? Technicians with permission to edit automations in the relevant group. See Workspace → Permissions for access control configuration.

Enable Disk Encryption Action