windows-itpro-docs/devices/hololens/hololens-encryption.md

title, description, ms.prod, ms.mktglfcycl, ms.sitesec, author, ms.author, ms.topic, ms.localizationpriority, ms.date

title	description	ms.prod	ms.mktglfcycl	ms.sitesec	author	ms.author	ms.topic	ms.localizationpriority	ms.date
Enable Bitlocker encryption for HoloLens (HoloLens)	Enable Bitlocker device encryption to protect files stored on the HoloLens	hololens	manage	library	jdeckerms	jdecker	article	medium	12/20/2017

Enable encryption for HoloLens

You can enable Bitlocker device encryption to protect files and information stored on the HoloLens. Device encryption helps protect your data by encrypting it using AES-CBC 128 encryption method, which is equivalent to EncryptionMethodByDriveType method 3 in the BitLocker configuration service provider (CSP). Only someone with the right encryption key (such as a password) can decrypt it or perform a data recovery.

Enable device encryption using MDM

You can use your mobile device management (MDM) provider to apply a policy that requires device encryption. The policy used is the Security/RequireDeviceEncryption setting in the Policy CSP.

In the following steps, Microsoft Intune is used as the example. For other MDM tools, see your MDM provider's documentation for instructions.

1. Sign in to the Microsoft Azure portal.

2. Use Search or go to More services to open the Intune blade.

3. Go to Device configuration > Profiles, and select Create profile.

   

4. Enter a name of your choice, select Windows 10 and later for the platform, select Custom for the profile type, and then select Add.

   

5. In Add Row OMA-URI Settings, enter or select the following information:

   • Name: a name of your choice
   • Description: optional
   • OMA-URI: ./Vendor/MSFT/Policy/Config/Security/RequireDeviceEncryption
   • Data type: integer
   • Value: 1

   

6. Select OK, select OK, and then select Create. The blade for the profile opens automatically.

7. Select Assignments to assign the profile to a group. After you configure the assignment, select Save.

Enable device encryption using a provisioning package

Provisioning packages are files created by the Windows Configuration Designer tool that apply a specified configuration to a device.

Create a provisioning package that upgrades the Windows Holographic edition

1. Create a provisioning package for HoloLens.

2. Go to Runtime settings > Policies > Security, and select RequireDeviceEncryption.

   

3. Browse to and select the XML license file that was provided when you purchased the Commercial Suite.

   Note

   You can configure additional settings in the provisioning package.

4. On the File menu, click Save.

5. Read the warning that project files may contain sensitive information, and click OK.

   Important

   When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.

6. On the Export menu, click Provisioning package.

7. Change Owner to IT Admin, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select Next.

8. Set a value for Package Version.

   Tip

   You can make changes to existing packages and change the version number to update previously applied packages.

9. On the Select security details for the provisioning package, click Next.

10. Click Next to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.

    Optionally, you can click Browse to change the default output location.

11. Click Next.

12. Click Build to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.

13. When the build completes, click Finish.

Apply the provisioning package to HoloLens

1. Connect the device via USB to a PC and start the device, but do not continue past the fit page of the initial setup experience (the first page with the blue box).

2. Briefly press and release the Volume Down and Power buttons simultaneously.

3. HoloLens will show up as a device in File Explorer on the PC.

4. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage.

5. Briefly press and release the Volume Down and Power buttons simultaneously again while on the fit page.

6. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package.

7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with device setup.

Note

If the device was purchased before August 2016, you will need to sign into the device with a Microsoft account, get the latest OS update, and then reset the OS in order to apply the provisioning package.

Verify device encryption

Encryption is silent on HoloLens. To verify the device encryption status:

• On HoloLens, go to Settings > System > About. Bitlocker is enabled if the device is encrypted.