Why BitLocker Encryption Status Differs Between CloudCapsule and Your RMM
BitLocker shows as encrypted in your RMM but non-compliant in CloudCapsule: protection suspension, key escrow, cipher mismatch, and CSP failures explain the gap.
How CloudCapsule and RMMs read encryption status
CloudCapsule retrieves encryption data from Microsoft Intune using the BitLocker CSP and evaluates policy conformance. RMM tools typically read volume state directly from WMI (Win32_EncryptableVolume), reporting whether a drive is physically encrypted regardless of configuration approach.
Both sources can be accurate while reporting different outcomes. A drive can be fully encrypted at the disk level while still failing Intune's compliance evaluation.
Common causes of discrepancies
Protection suspended, not off
A drive can be 100% encrypted while BitLocker protection is temporarily suspended, pending a TPM or firmware update, or a staged reboot. Intune evaluates Protection Status = On, so it reports the device as unprotected even though the disk is fully converted.
Recovery key not escrowed to Entra ID
If BitLocker was enabled manually, by the RMM, or by the OEM and the recovery key was never stored in Entra ID, Intune flags the device as not Intune-managed. If your compliance policy requires key escrow, the device will be marked non-compliant even though the volume is genuinely encrypted.
Cipher or scope mismatch with the disk encryption profile
If your BitLocker configuration profile requires XTS-AES 256 and full-disk encryption, but the drive was encrypted using XTS-AES 128 or used-space-only, Intune sees a policy mismatch. The RMM reports a boolean "encrypted = true" while Intune reports "does not match configured policy."
Reporting lag or CSP failure
Intune encryption status only updates on MDM check-in. The BitLocker CSP or WMI provider can return errors, particularly when a conflicting BitLocker Group Policy Object is still in place or FixedDrivesRecoveryOptions is managed via GPO.
Summary of scenarios
Protection suspended: RMM reports encrypted; Intune / CloudCapsule reports not protected.
Key not escrowed to Entra ID: RMM reports encrypted; Intune / CloudCapsule reports non-compliant (not Intune-managed).
Cipher or scope mismatch: RMM reports encrypted; Intune / CloudCapsule reports non-compliant (policy mismatch).
CSP failure or GPO conflict: RMM reports encrypted; Intune / CloudCapsule reports unknown or not encrypted.
When to contact support
If you cannot explain the discrepancy for a specific device or tenant, contact support with:
- The name of the affected tenant
- The device name and Intune device ID if available
- What your RMM reports versus what CloudCapsule shows
- Whether a BitLocker configuration profile or compliance policy is assigned to the device in Intune
Email: support@cloudcapsule.io · In-app: Navigate to Support and open a new ticket.