Evaluating Endpoint Encryption Solutions: MBAM vs Intune/SCCM

Question

A client currently utilizes MBAM for encrypting laptops and USB drives and has a test Azure tenant along with an SCCM Lab. In the production environment, SCCM is fully responsible for managing workstation policies.

A POC is being prepared to facilitate the client's evaluation of switching to or testing endpoint encryption with Intune and SCCM. Key considerations include Hybrid Join/Co-Management and secure key management, ensuring minimal impact on SCCM. The SCCM database must remain unchanged, and the platform should undergo only minimal alterations.

What procedures and technical solutions should be followed? Are there any best practices to apply?

Kind regardsand thanks in advance,

Alessio

Answer 1

1. Key Considerations for POC and Strategy

• Preserve SCCM Management: Ensure that the POC introduces co-management without altering the existing SCCM database and policies.
• Hybrid Identity: Use Hybrid Azure AD Join for devices to support both on-premises and cloud-based management.
• Encryption Management: Shift encryption to BitLocker managed via Intune or SCCM.
• Secure Key Management: Store recovery keys securely in Azure AD or on-premises via SCCM.

---

2. Recommended Technical Approach

Step 1: Enable Co-Management and Device Enrollment

• Enable Co-Management in SCCM to manage BitLocker policy through Intune without disrupting existing SCCM management.
  • In SCCM, go to Administration > Cloud Services > Co-management and configure the workload.
  • Configure BitLocker management policies to shift to Intune without moving other workloads.
  • Ensure Hybrid Azure AD Join for seamless device enrollment with both SCCM and Intune.

Step 2: Configure BitLocker Management in SCCM and Intune

SCCM Configuration:

• Verify that BitLocker management policies are already configured in SCCM for on-premises.
  • Use SCCM’s MBAM integration for legacy devices if needed
  • Keep the SCCM database unchanged by maintaining the on-prem recovery key storage.

Intune Configuration:

• In Intune, create a Device Configuration Policy for BitLocker under Endpoint security > Disk encryption.
  • Store BitLocker recovery keys in Azure AD for Intune-managed devices.
  • Exclude SCCM-managed devices from Intune’s BitLocker policy to avoid conflicts.

Step 3: Configure Recovery Key Management

• Azure AD Recovery Keys: For devices managed by Intune, ensure recovery keys are stored securely in Azure AD.
• On-prem Recovery Key Storage: Keep the SCCM/MBAM key storage for devices still managed on-premises.
• Implement RBAC roles in Intune to control access to recovery keys securely.

---

3. Key Best Practices
   1. Minimal Disruption: Roll out the POC with minimal changes to SCCM, ensuring devices can switch to Intune only for encryption management.
   2. Pilot Group Testing: Select a pilot group of devices to validate policies from both SCCM and Intune during the transition.
   3. Avoid Policy Conflicts: Carefully exclude devices managed by SCCM from Intune encryption policies.
   4. Backup Recovery Keys: Ensure a backup process is in place for recovery keys, whether in Azure AD or SCCM.
   5. Reporting and Compliance: Use Intune compliance policies to monitor encryption status and ensure the new policies are effective.
   6. MFA for Key Access: Secure recovery key access in Azure AD with MFA to prevent unauthorized access.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

@49885604, Thanks for posting in Q&A. For MBAM and SCCM, they are on-premises BitLocker management method. For Microsoft Intune, it is cloud-based BitLocker management method. To simplify the administration or you consider cloud management in your organization, we can plan to migrate MBAM data to Microsoft Intune. Here is a blog with more details.

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/mbam-server-migration-to-microsoft-endpoint-manager/ba-p/2192984

To ensure minimal impact, you can use Pilot group when enable co-management. Use a pilot group for your initial testing, adding devices as needed, until you're ready to move the workloads for all Configuration Manager devices.

https://learn.microsoft.com/en-us/mem/configmgr/comanage/how-to-enable

Hope the above information can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.