Which Intune Compliance Settings Enforce BitLocker and Minimum OS Version?

MD-102 By islever Editorial Last updated

Implement identity and compliance

Short answer

Drag Device Health to the BitLocker requirement and Device Properties to the minimum OS version requirement; Device Health includes the BitLocker rule, and Device Properties includes Minimum OS version.

Question

DRAG DROP
You have a Microsoft 365 subscription. The subscription contains computers that run Windows 11 and are enrolled in Microsoft Intune.
You need to create a compliance policy that meets the following requirements:
Requires BitLocker Drive Encryption (BitLocker) on each device
Requires a minimum operating system version
Which setting of the compliance policy should you configure for each requirement? To answer, drag the appropriate settings to the correct requirements. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Exhibit: Which Intune Compliance Settings Enforce BitLocker and Minimum OS

Key Takeaways

The item tests Intune Windows compliance policy category placement, and the trap is selecting System Security for BitLocker instead of the attestation-based Device Health setting.

In Microsoft Intune, the Windows compliance policy enforces BitLocker through Device Health and minimum OS version through Device Properties. This page confirms the drag-and-drop mapping for the MD-102 scenario.

Common mistake: Candidates often drag System Security for BitLocker because encryption appears there in other policy contexts, but this exhibit expects Device Health for the BitLocker rule and Device Properties for the OS version.

Expert Analysis

Why the Answer Is Correct

The BitLocker requirement maps to Device Health because that section contains the Windows Health Attestation rule that requires BitLocker to be enabled on the device. The minimum OS version requirement maps to Device Properties because that section exposes OS version and build fields, including Minimum OS version. In the drag-and-drop item, selecting Device Health for BitLocker and Device Properties for the OS version is therefore the expected pairing.

Why Other Candidate Answers Are Wrong

Dragging Device Properties onto BitLocker fails because Device Properties reports OS and build information, not encryption state. Dragging System Security onto the minimum OS requirement fails because System Security focuses on password, firewall, Defender, and related security controls, not the OS version floor. Although some Intune documentation also exposes BitLocker-related encryption settings under System Security, this MD-102 item is keyed to the Device Health attestation rule for BitLocker.

Community Comment Notes

krzysztofbr linked the Microsoft Windows compliance policy article and said the "answers are correct". TylerSivis summarized the expected pairing as Device Health for the first requirement and Device Properties for the second. RomanV explained that Device Health relies on Microsoft device attestation, while Device Properties exposes build versions, which supports the same mapping. ThomasE noted that "BitLocker can be either Device Health or System Security" and favored Device Health for TPM-attestation-first policies.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Memorize the Intune Windows compliance policy sections: Device Health holds attestation checks such as BitLocker, Secure Boot, and TPM, while Device Properties holds OS version and build limits. If a drag item mentions an OS version floor, target Device Properties immediately.

Frequently Asked Questions

Why does BitLocker map to Device Health in this Intune compliance item?

Device Health uses Windows Health Attestation rules, including BitLocker, Secure Boot, and TPM checks; System Security also has encryption controls, but this exhibit expects Device Health.

Where is Minimum OS version configured in an Intune Windows compliance policy?

Under Device Properties, which contains OS version and build fields such as Minimum OS version and Maximum OS version.

More MD-102 FAQ →

Discussion 15 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 15

  1. krzysztofbr 👍 30
    answers are correct https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows
  2. maggie22 👍 7
    it should be system security for bitlocker
  3. TylerSivis 👍 4
    The Answer Is Device Health > Device Properties. But I just want to say that this question is dumb as bricks. It basically boils down to "What is the setting syntax called" and no tech I know has this memorized by heart. Pointless Question if you ask me
  4. MR_Eliot 👍 4
    Answers are correct.
  5. RomanV 👍 3
    Device health: To ensure devices boot to a trusted state, Intune utilizes Microsoft device attestation services. Devices across Intune commercial, US Government GCC High, and DoD services running Windows 10 use the Device Health Attestation (DHA) service. Device Properties: To discover build versions for all Windows 10/11 Feature Updates and Cumulative Updates (to be used in some of the fields below), see Windows release information. Be sure to include the appropriate version prefix before the build numbers, like 10.0 for Windows 10 as the following examples illustrate.
Show 10 more comments
  1. ThomasE 👍 1
    Minimum OS version is definitely Device Properties. However, seems BitLocker can be either Device Health or System Security. Both have BitLocker settings. Device Health is better for security‑first policies where you want to trust TPM attestation and avoid blocking users mid‑encryption. System Security is better for completeness‑first policies where you require encryption to be fully applied before compliance. If you use conditional access, choose based on whether you want to allow access during encryption (Device Health) or only after it’s complete (System Security)
  2. _Dinkan_ 👍 1
    Requires BitLocker: Device Health Minimum OS Version: Device Properties https://learn.microsoft.com/en-us/intune/intune-service/protect/compliance-policy-create-windows#windows-health-attestation-service-evaluation-rules https://learn.microsoft.com/en-us/intune/intune-service/protect/compliance-policy-create-windows#operating-system-version
  3. gv_myra 👍 1
    It's not. It is Device Health. https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows#device-health
  4. Darkfire 👍 1
    Answers are correct idd https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows
  5. ollyijeh 👍 1
    Device health allows bitlocker to be configured and Device properties specifies the OS version
  6. Casticod 👍 1
    My comment should be generate dudes Correct With the option posted by Maggie22
  7. Casticod 👍 1
    Correct: https://www.anoopcnair.com/bitlocker-compliance-policy-using-intune/
  8. Richard_rex 👍 1
    The Answer is correct, Lab tested
  9. NoursBear 👍 1
    no, check it in your Tenant
  10. Amir1909 👍 1
    Correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Assigning Intune and Cloud PC Roles with Least Privilege

S-grade

SCEP Root Certificate Location for Intune

S-grade

How Many Intune Profiles Are Needed for Cloud PKI User Certificates?

S-grade

What Must Be Purchased First for Intune Device Query at Minimum Cost?

S-grade

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide