Introduction
Enforce disk encryption on managed devices without touching each one manually. This action enables BitLocker on Windows and FileVault on macOS, targeting the system drive or all drives depending on your configuration.
Enable Disk Encryption
From the automation pipeline in edit mode, click + Add action and select Enable disk encryption from the Security category. The action panel opens with two sections: Action type (pre-set to Enable disk encryption) and Step configuration.
Disk Drive
🖥️ PLATFORM NOTE:
Windows: Both options are available. Any drive targets all attached drives; System drive only targets the boot/OS drive. Uses BitLocker.
macOS: Always treated as System drive only, regardless of which option is selected. Uses FileVault.
Linux: Not supported. This action is not implemented on Linux.
The Disk drive dropdown controls which drives Level targets for encryption.
Option | Behavior |
Any drive | Enables encryption on all drives on the device. Windows only. |
System drive only | Enables encryption on the OS drive only. Applies to Windows, macOS, and Linux. |
ℹ️ NOTE: If your automation targets a mixed-OS group that includes macOS devices, selecting Any drive won't cause an error — macOS devices will encrypt the system drive only regardless.
Conditions
The Conditions section lets you restrict when this action runs based on device attributes or the outcome of a previous action. Expand the section to add conditions.
See Action Conditions for the full reference on condition types, operators, and values.
Additional Options
Expand Additional options for execution settings including action name, failure behavior, output variables, and retries.
See Actions Overview for the full reference on additional options available on every action.
FAQ
Does this action work on Linux? No. Disk encryption is not implemented for Linux. If your automation targets a mixed-OS group, only Windows and macOS devices will execute this step.
What encryption method does Level use on each platform? BitLocker on Windows and FileVault on macOS. Level invokes the OS-native encryption tool — it doesn't install third-party encryption software.
Why is "Any drive" labeled Windows only? macOS always encrypts the system drive only, regardless of which option is selected. The Any drive option has no additional effect on macOS.
What happens if encryption is already enabled on the device? Level skips the drive and moves on — no error, no duplicate operation. If the drive is fully protected or encryption is already in progress, Level logs the status and returns success. For multi-drive targets, it skips already-encrypted drives and enables encryption only on the ones that need it.
Will enabling encryption require a reboot? No. Level uses the
-SkipHardwareTestflag when enabling BitLocker, which bypasses the hardware compatibility test that normally triggers a reboot. Encryption starts immediately. Level also uses-UsedSpaceOnly, so only the used portion of the disk is encrypted — not the entire volume — which makes the process faster.What happens if the device is offline when the action runs? The action queues and resumes once the device comes back online.
Who can add or modify this action in an automation? Technicians with permission to edit automations in the relevant group. See Workspace → Permissions for access control configuration.