Encrypting data on the virtual desktop
Encrypting data on a physical Windows desktop is usually done by leveraging BitLocker Drive Encryption (BitLocker for short). BitLocker can be configured individually on a desktop or managed centrally via a GPO or a policy in Microsoft Intune.
BitLocker uses AES encryption and stores the encryption keys in the Trusted Platform Module (TPM) chip on the motherboard of the desktop. Nowadays, modern desktops are equipped with a compatible TPM chip but it’s also possible to store the encryption keys on removable storage if the desktop does not have a TPM chip. For centrally managed desktops it’s possible to store the BitLocker recovery key in Active Directory or Entra ID. But what about Cloud PCs?
Encryption for Windows 365 Cloud PCs
BitLocker is not supported for Windows 365 Cloud PCs. Instead, Windows 365 uses the following two techniques to keep data safe:
- Encryption of data at rest
- Encryption of data in transit...