MT.1123: detect BitLocker configured via Settings catalog - #2144
Conversation
Test-MtBitLockerFullDiskEncryption filtered configurationPolicies on templateReference/templateFamily eq 'endpointSecurityDiskEncryption', which only matches policies authored through Endpoint security > Disk encryption. Every device_vendor_msft_bitlocker_* definition is published with visibility 'settingsCatalog,template', so BitLocker configured through Devices > Configuration > Settings catalog is invisible to the test and it reports "No Endpoint Security Disk Encryption policies found" -- telling the admin to create a policy that already exists. Query Windows configuration policies instead and identify BitLocker policies by their settings. Non-BitLocker policies are skipped, so Personal Data Encryption profiles sharing the endpointSecurityDiskEncryption family no longer count towards the policy total. Also adds the missing Test-MtConnection Graph check and reports whether each policy was authored via Endpoint Security or the Settings catalog. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 4 included reviews per hour; 2 remain after this review. 📝 WalkthroughWalkthroughThe BitLocker test now evaluates all Windows Intune configuration policies, including Endpoint Security and Settings catalog policies. It detects BitLocker settings, reports configuration sources, handles Graph and licensing skips, and adds comprehensive Pester coverage. ChangesBitLocker policy coverage
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to The PR expands BitLocker detection to Settings catalog policies and adds regression coverage; no actionable merge-blocking risk remains after normal checks and review. Sequence Diagram(s)sequenceDiagram
participant IntuneTest
participant MicrosoftGraph
participant TestReport
IntuneTest->>MicrosoftGraph: Check connection
IntuneTest->>MicrosoftGraph: Retrieve Windows configuration policies
MicrosoftGraph-->>IntuneTest: Return policy settings
IntuneTest->>TestReport: Record encryption mode and configuration source
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Up to standards ✅🟢 Issues
|
There was a problem hiding this comment.
Pull request overview
Updates the MT.1123 BitLocker full-disk-encryption check to correctly detect BitLocker settings configured via Devices > Configuration > Settings catalog, not just profiles authored under Endpoint security > Disk encryption, eliminating false “no policy found” results and improving reporting.
Changes:
- Expands policy discovery to Windows configuration policies and identifies BitLocker policies by the BitLocker setting definition IDs they contain.
- Enhances output to show whether each detected BitLocker policy was configured via Endpoint Security or Settings catalog.
- Adds unit tests covering settings-catalog detection, exclusion of non-BitLocker policies sharing the template family, and skip conditions.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| powershell/public/maester/intune/Test-MtBitLockerFullDiskEncryption.ps1 | Detect BitLocker settings across Windows policies; refine results table and skip gating. |
| powershell/tests/functions/Test-MtBitLockerFullDiskEncryption.Tests.ps1 | New unit tests validating settings-catalog detection and edge cases. |
| powershell/public/maester/intune/Test-MtBitLockerFullDiskEncryption.md | Updates companion documentation to reflect support for both authoring surfaces. |
Suppressed comments (1)
powershell/public/maester/intune/Test-MtBitLockerFullDiskEncryption.ps1:27
- The comment-based help under .EXAMPLE still refers to a "Disk Encryption policy" and uses inconsistent capitalization ("Used space only"). Since this function now evaluates BitLocker settings across all Windows configuration policies, the help text should be updated to match the current behavior and wording.
The test passes only if at least one BitLocker policy has the OS drive encryption type set to
"Full encryption". It fails if no BitLocker settings exist in any policy, if encryption type is
set to "Used space only", or if the encryption type setting is not configured.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Same root cause as #2143, different test.
Problem
Test-MtBitLockerFullDiskEncryptionfilters policies ontemplateReference/templateFamily eq 'endpointSecurityDiskEncryption', which only matches profiles created under Endpoint security > Disk encryption.Every
device_vendor_msft_bitlocker_*setting definition is published withvisibility: "settingsCatalog,template"— including the four this test reads (systemdrivesencryptiontype,fixeddrivesencryptiontype,requiredeviceencryption,encryptionmethodbydrivetype). BitLocker configured through Devices > Configuration > Settings catalog therefore lands ontemplateFamily: "none"and is invisible to the test.Verified against a tenant holding a
CIS (BL) BitLocker - Windows 11 Intune 5.0.0settings-catalog policy with 7 BitLocker settings configured. MT.1123 reported:That policy exists. It just has Used Space Only on OS drives — so the check still fails, but for the wrong reason and with remediation advice that sends the admin to create a duplicate policy instead of changing one dropdown in the one they have. In any tenant where a settings-catalog BitLocker policy does set Full encryption, it's a straight false negative.
Related: Personal Data Encryption profiles also carry the
endpointSecurityDiskEncryptionfamily, so they counted towards the Disk Encryption policy total despite configuring no BitLocker settings.Fix
$filter=platforms has 'windows10') and identify BitLocker policies by the settings they contain, not by template family.Test-MtConnection Graphcheck, which this helper lacked.Trade-off: one
/settingscall per Windows policy. Graph has no server-side filter on setting definition IDs, so this is unavoidable for correctness;platforms has 'windows10'narrows the set and theInvoke-MtGraphRequestsession cache absorbs repeats.Testing
New
powershell/tests/functions/Test-MtBitLockerFullDiskEncryption.Tests.ps1, 6/6 passing:$true(the regression)$false, with the policy still named in the output rather than claiming none exists$falsePSScriptAnalyzer clean.
Docs
Companion
.mdupdated: notes that both authoring surfaces count, and the rationale section was tightened. Generated pages (MT.1123.md, the command.mdx) left untouched —update-test-docs.yamlandupdate-module-docs.yamlrefresh those on push tomain.One thing worth deciding before you open it: the test still gates only on the OS drive. That CIS policy has FixedEncryptType: Not configured, which stays unflagged even now that the policy is visible. That's existing design, not a regression, so I left it out of scope — but it may be worth raising in the PR thread or as a separate issue.
Summary by CodeRabbit
New Features
Bug Fixes
Documentation