Is data encrypted at rest on endpoints (laptops, desktops, portable devices)?
This is one of the few controls that changes whether an incident is a notifiable breach at all, which is why carriers care about it out of proportion to its cost.
What the carrier is actually asking
The carrier is asking whether the storage in laptops, desktops, and portable devices is encrypted, so that a lost or stolen device does not become a data breach. It usually means full-disk encryption with keys escrowed centrally rather than a user-managed passphrase.
Why it is underwritten
In many jurisdictions, loss of an encrypted device with keys intact is not a reportable breach, while loss of an unencrypted one is. That single distinction is the difference between an inconvenience and a notification exercise with regulatory exposure and credit monitoring costs. The carrier pays for the second outcome.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Encryption state on managed endpoints is measurable through device management, and key escrow is visible in the directory.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Microsoft 365 | Intune disk encryption policy and per-device encryption state | Encryption enforced by policy and confirmed present per device, not merely enabled in a baseline |
| Entra ID | BitLocker recovery key escrow to the directory | Keys escrowed, and recovery key read access restricted so that escrow does not become an exposure of its own |
| Microsoft 365 | Compliance policy requiring encryption, tied to Conditional Access | An unencrypted device fails compliance and loses access, which is the enforcement half |
| Azure | Disk encryption on virtual machines and unattached disks | The server-side equivalent, including disks left behind after decommissioning |
| Endpoint fleet | macOS FileVault and Linux volume encryption state | Non-Windows devices covered by an equivalent policy rather than assumed |
Recovery keys stored in the directory can be read by more roles than most organisations expect. Restricting who can retrieve them matters, because an attacker with directory access and recovery key visibility can unlock the devices they physically obtain later.
What a defensible yes requires
- Encryption is enforced by policy and verified per device rather than assumed from the image.
- Recovery keys are escrowed centrally, with read access restricted to a small role.
- Non-Windows endpoints are covered by equivalent policy.
- Removable media is addressed, whether by encryption or by blocking it entirely.
- Compliance enforcement means an unencrypted device cannot reach corporate data.
How this answer goes wrong
Encryption is in the standard image, so the answer is yes, and the estate contains devices built before the standard changed, devices rebuilt manually, and devices from an acquisition. Nobody has checked per-device state. The second failure is escrow: encryption on and keys held only by the user, which protects the data and prevents the organisation from recovering it.
Frequently asked
Does this apply to phones?
Modern mobile platforms encrypt by default when a passcode is set, so the practical control is requiring a passcode and enforcing it through device or application policy.
What about removable media?
Carriers ask about portable devices deliberately. Either encrypt removable media by policy or block it, and say which you chose.
Does encryption help against ransomware?
No. It protects against loss and theft of the device. It is worth being clear on that, because conflating the two weakens both answers.
How do we prove it per device?
Export the encryption state report from device management. It shows state rather than policy, which is exactly the distinction an adjuster will draw.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture