Introduction
FileVault is Apple’s built-in full-disk encryption technology for macOS. While users can enable it manually in System Settings, corporate environments require enforcement and key escrow to ensure data security and prevent data loss if a user forgets their password. This guide explains how to mandate FileVault encryption and securely escrow the Personal Recovery Key (PRK) using a Mobile Device Management (MDM) solution.
Prerequisites
You require an MDM platform (such as Jamf Pro, Microsoft Intune, or Kandji) and supervised Mac computers running macOS 10.13 or newer. The Macs must have a valid local user account capable of unlocking the disk.
Step 1: Create a FileVault Configuration Profile
Log into your MDM dashboard and navigate to the macOS Configuration Profiles section. Create a new profile and locate the FileVault payload.
Step 2: Enforce Encryption
Configure the profile to Require FileVault. When this payload hits the Mac, the operating system will prompt the user to enable encryption at the next login or logout, depending on your specific MDM settings.
Step 3: Configure the Recovery Key
A crucial step in enterprise deployment is managing the recovery key. Do not allow users to use their iCloud account to unlock the disk, as this circumvents corporate control.
- Select Personal Recovery Key (PRK). This generates a unique, alphanumeric key for each specific Mac.
- Do not select Institutional Recovery Key (IRK) unless you are maintaining legacy systems, as Apple has deprecated IRKs for Apple Silicon Macs.
- Ensure the option to Escrow Personal Recovery Key is enabled. This setting instructs the Mac to silently encrypt the newly generated PRK and transmit it securely back to your MDM server.
- Optionally, choose whether to display the recovery key to the user during the initial setup. Hiding it provides better security, forcing the user to contact the Helpdesk if they get locked out.
Step 4: Deploy the Profile
Save the Configuration Profile and assign it to your target macOS devices or device groups. Once the Mac receives the APNs push notification, the profile will install.
Step 5: User Experience and Verification
The next time the user logs out or restarts their Mac, macOS will intercept the process and present a FileVault enablement screen. The user must enter their login password to authorize the encryption. The encryption process occurs seamlessly in the background while the Mac is awake and plugged into power.
To verify the deployment was successful, check your MDM inventory for the specific computer. You should see the FileVault status listed as “Encrypted,” and the MDM should display a button allowing authorized administrators to view the escrowed Personal Recovery Key.