How do I encrypt my laptop?
Updated October 30, 2026
Windows laptops and Macs can both encrypt themselves at no extra cost, but it isn’t always on, so check first. On Windows, look under Settings, Privacy & security, Device encryption, or use BitLocker on Windows Pro. On a Mac, turn on FileVault. Then make sure the recovery key is somewhere your business can reach, not a personal account or the laptop itself. Without it, a locked-out laptop’s files can be lost for good.
Steps
- Windows: check whether it’s already on. Open Settings, then Privacy & security, then Device encryption. An upgraded laptop may never have been encrypted automatically.
- If Device encryption isn’t there, look for BitLocker. On Windows Pro, search Start for “Manage BitLocker.” If neither appears, sign in as an administrator and look again.
- Decide where the recovery key goes before you turn it on. A work account usually saves it to your company. A personal Microsoft account saves it to that person.
- Turn it on as an administrator. Switch Device encryption to On, or choose Turn on BitLocker. The laptop stays usable while it encrypts.
- Confirm the key is in a company account. From another device, sign in at aka.ms/aadrecoverykey and open Devices. Can’t see the key? Ask your administrator.
- Mac: turn on FileVault. Open System Settings, Privacy & Security, FileVault. On a work Mac, pick a recovery key, not iCloud, and store it where the business can reach it.
- Repeat for every laptop and write down the result: who has it, whether it’s encrypted, where the key is, and the date you checked.
Details
What encryption protects, and what it doesn’t
Encryption protects the files on a laptop that’s lost or stolen while it’s turned off, and that’s its whole job: without your sign-in or the recovery key, nobody can read the drive, even by pulling it out. It doesn’t protect a laptop that’s signed in and unlocked, it doesn’t stop malware, and it isn’t a backup. For what to do if one goes missing, see Company laptop lost or stolen?
Device encryption and BitLocker are the same lock
Device encryption is BitLocker switched on for you, so either one counts as an encrypted laptop. Windows turns it on by itself when someone first sets up the laptop and signs in with a Microsoft, work, or school account, if the hardware supports it. A laptop set up with only a local account doesn’t get it automatically. Since Windows 11 version 24H2, more laptops qualify, including ones running Windows Home, but a laptop that was upgraded rather than freshly set up isn’t encrypted automatically. BitLocker Drive Encryption, on Windows Pro, Enterprise, and Education, gives administrators more control.
If neither option appears, open System Information as an administrator and look at Device Encryption Support. It tells you why, such as the security chip (TPM) being switched off.
The recovery key decides whether you get the files back
Where the recovery key is stored matters more than the encryption itself, because it’s the only way in when Windows asks for it after some hardware or startup changes. Microsoft Support can’t retrieve or recreate a lost key. Where it usually ends up:
- A work or school account: in your organization’s Microsoft Entra ID. The user can often see it at aka.ms/aadrecoverykey, and an administrator can retrieve it.
- A personal Microsoft account: at aka.ms/myrecoverykey. If someone else set the laptop up, the key may be in their account, which is the case that bites when an employee leaves.
- Printed or saved to a file: fine as a second copy, as long as it isn’t kept with the laptop.
Macs: FileVault adds the password lock
FileVault is the Mac’s version of the same lock. Macs with Apple silicon or a T2 chip already encrypt their drives, but FileVault makes that encryption require your login password; older Macs aren’t encrypted at all without it. You need to be an administrator, and the Mac asks how you’d unlock the disk if the password is forgotten:
- Your iCloud account: convenient, but it ties a work laptop to one person’s Apple Account, the same problem as a key in a personal Microsoft account.
- A recovery key: a code you keep somewhere other than the Mac. For a work laptop, this is the better choice, stored where the business can reach it.
Apple warns that if both the password and the recovery key are lost, the files are gone for good. A business’s device management tool can also set its own recovery key (Apple: Protect data on your Mac with FileVault).
Set laptops up so the key lands in the right place
Sign every new Windows laptop in with a work account from the first setup, and the key goes to your company account without anyone having to remember. Avoid setting up work laptops with a personal Microsoft account or a local account. Past a handful of laptops, a device management tool such as Microsoft Intune, included in Microsoft 365 Business Premium, reports encryption and keeps the keys in one place, so you check one list instead of each laptop.
What you can leave alone
If a Windows laptop shows encryption on and its key is in your company account, it’s done, and so is a Mac with FileVault on and its key stored by the business. You don’t need extra encryption software, and you don’t need to switch from Device encryption to full BitLocker. The one gap to know about: Device encryption covers the laptop’s own drives, not USB drives, so keep company files off them.
Where doing it yourself gets risky
- A recovery key that lives in a former employee’s personal Microsoft or iCloud account.
- A key saved only on the same laptop, which is useless when the laptop is the thing that’s missing or locked.
- Assuming every laptop is covered. A local account, or a laptop that was upgraded instead of freshly set up, may not be encrypted.
- Treating encryption as a backup. It won’t bring back deleted files.
Signs it’s time for help
It’s time for help when a lost laptop holding customer or financial records would cost more than encrypting it and tracking the keys. Signs it would:
- Your laptops hold customer records, financial files, or saved passwords.
- You have more than a couple of laptops and can’t say which are encrypted.
- Nobody holds the recovery keys in a company account.
- A client or an insurer is asking about encryption.
Check one laptop today: confirm encryption is on, then find its recovery key in your company account. If you’d rather not track this yourself, we make sure BitLocker is on for every computer we manage and keep the recovery keys in your own Microsoft 365 account.
Book a free 20-minute fit check