Protect devices
Layered protection
Protection combines identity, device, and threat controls. Conditional Access uses compliance and app protection signals to gate access. Security baselines apply a Microsoft-recommended group of Windows settings, while endpoint security policies target specific workloads: antivirus, firewall, attack surface reduction (ASR), disk encryption, EDR, and account protection.
Encryption and credentials
BitLocker policies silently enable encryption on Entra joined devices with a TPM and escrow recovery keys to Microsoft Entra ID (or AD DS for hybrid). Windows Hello for Business replaces passwords with keys. Windows LAPS rotates and backs up local administrator passwords to Entra ID or AD. Defender for Endpoint onboarding packages enroll devices, and tamper protection stops users from disabling antivirus. Defender for Endpoint can also manage devices that are not enrolled in Intune through security settings management.
Traps
Questions mix up baselines and endpoint security policies, assume BitLocker keys escrow automatically without configuration, or overlook that Conditional Access needs a compliance or app protection signal to be meaningful. Some capabilities require specific licensing, such as Defender for Endpoint Plan 2 or Microsoft Entra ID P1 for Conditional Access.
Rule of thumb
For BitLocker, always pair 'enable' with 'escrow to Entra ID' and a TPM requirement; a device that encrypts without escrow creates recovery risk.