Enable encryption for HoloLens
You can enable BitLocker device encryption to protect files and information stored on the HoloLens. Device encryption helps protect your data by encrypting it using AES-CBC 128 encryption method, which is equivalent to EncryptionMethodByDriveType method 3 in the BitLocker configuration service provider (CSP). Only someone with the right encryption key (such as a password) can decrypt it or perform a data recovery.
Enable device encryption using MDM
You can use your mobile device management (MDM) provider to apply a policy that requires device encryption. The policy used is the Security/RequireDeviceEncryption setting in the Policy CSP.
For other MDM tools, see your MDM provider's documentation for instructions. If your MDM provider requires custom URI for device encryption, use the following configuration:
- Name: a name of your choice
- Description: optional
- Data type: integer
Enable device encryption using a provisioning package
Provisioning packages are files created by the Windows Configuration Designer tool that apply a specified configuration to a device.
Create a provisioning package that upgrades the Windows Holographic edition and enables encryption
Go to Runtime settings > Policies > Security, and select RequireDeviceEncryption.
Browse to and select the XML license file that was provided when you purchased the Commercial Suite.
You can configure additional settings in the provisioning package.
On the File menu, click Save.
Read the warning that project files may contain sensitive information, and click OK.
When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
On the Export menu, click Provisioning package.
Change Owner to IT Admin, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select Next.
Set a value for Package Version.
You can make changes to existing packages and change the version number to update previously applied packages.
On the Select security details for the provisioning package, click Next.
Click Next to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.
Optionally, you can click Browse to change the default output location.
Click Build to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.
When the build completes, click Finish.
Apply the provisioning package to HoloLens
Connect the device via USB to a PC and start the device, but do not continue past the fit page of the initial setup experience (the first page with the blue box).
Briefly press and release the Volume Down and Power buttons simultaneously.
HoloLens will show up as a device in File Explorer on the PC.
In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage.
Briefly press and release the Volume Down and Power buttons simultaneously again while on the fit page.
The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package.
You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with device setup.
If the device was purchased before August 2016, you will need to sign into the device with a Microsoft account, get the latest OS update, and then reset the OS in order to apply the provisioning package.
Verify device encryption
Encryption is silent on HoloLens. To verify the device encryption status:
- On HoloLens, go to Settings > System > About. BitLocker is enabled if the device is encrypted.