How to Implement Remote Team macOS FileVault Enforcement Through MDM Policy

FileVault, Apple’s native full-disk encryption technology, is essential for securing sensitive data on macOS devices—particularly critical for remote teams where employees work from various locations and networks. Implementing FileVault enforcement through Mobile Device Management (MDM) ensures all company devices are protected without requiring physical access. This guide walks through the complete implementation process for distributed teams using leading MDM solutions.

Why FileVault Enforcement Matters for Remote Teams

Remote work introduces increased security risks: employees accessing company data from home networks, coffee shops, hotels, and other potentially unsecured locations. Without full-disk encryption, a lost or stolen laptop exposes sensitive data to unauthorized access.

FileVault provides:

Automatic encryption: All data on the startup disk is encrypted with AES-128 or AES-256
Secure key management: Recovery keys can be stored with MDM for IT recovery
Compliance support: Helps meet SOC 2, HIPAA, GDPR, and other regulatory requirements
Transparent to users: Encryption happens in the background without impacting performance

Prerequisites for MDM-Based FileVault Enforcement

Before implementing FileVault enforcement, ensure you have:

Apple Business Manager or Apple School Manager enrollment for MDM
Compatible MDM solution: Jamf Pro, Kandji, Microsoft Intune, or similar
Apple Push Notification service (APNs) certificate configured
Recovery key escrow mechanism in place
User communication plan for rollout

MDM Solution Setup for FileVault Enforcement

Jamf Pro Configuration

Jamf Pro provides FileVault management through its built-in configuration profiles.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>FV2_MasterKeyKeyType</key>
            <string>Recovery</string>
            <key>FV2_OnReboot</key>
            <true/>
            <key>PayloadDisplayName</key>
            <string>FileVault</string>
            <key>PayloadEnabled</key>
            <true/>
            <key>PayloadType</key>
            <string>com.apple.FileVault2</string>
            <key>PayloadUUID</key>
            <string>B5D15C3E-4A2B-4F91-9E8A-7D7B3C1A2F9E</string>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>FileVault Enforcement</string>
    <key>PayloadIdentifier</key>
    <string>com.jamf.connect.filevault-1</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>A1B2C3D4-E5F6-7890-ABCD-EF1234567890</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Kandji Configuration

Kandji simplifies FileVault enforcement with a dedicated Blueprint profile.

// Kandji Blueprint - FileVault Configuration
{
  "name": "FileVault Encryption Enforcement",
  "device_type": "Mac",
  "items": [
    {
      "name": "Enable FileVault",
      "library": "Security",
      "payload_type": "com.apple.FileVault2",
      "settings": {
        "Enable": true,
        "EncryptOnLogout": false,
        "DeferUntilFirstUserAuthenticated": true,
        "KeyType": "Recovery",
        "Key escrow": "Kandji"
      }
    },
    {
      "name": "Require FileVault",
      "library": "Compliance",
      "payload_type": "com.apple.Security.encryption.filevault",
      "settings": {
        "action": "encrypt",
        "enforcement": "required"
      }
    }
  ]
}

Microsoft Intune Configuration

For organizations using Microsoft Intune, configure FileVault through Apple Device Enrollment Program.

// Intune macOS Endpoint Protection Policy
{
  "@odata.type": "#microsoft.graph.endpointProtectionConfiguration",
  "id": "filevault-policy-001",
  "displayName": "FileVault Enforcement Policy",
  "description": "Requires FileVault encryption for all macOS devices",
  "encryptionPolicy": {
    "fileVault": {
      "enabled": true,
      "keyType": "recoveryKey",
      "recoveryKeyType": "institutional",
      "escrowLocation": "https:// Intune endpoint"
    }
  },
  "assignment": {
    "includeGroups": ["Remote-Employees", "All-macOS-devices"]
  }
}

Implementing Recovery Key Escrow

Recovery key escrow is critical—it allows IT administrators to unlock encrypted drives when users forget their passwords while maintaining security.

Escrow with Jamf Pro

#!/bin/bash
# Jamf Pro Recovery Key Escrow Script

# Get the current user's FileVault recovery key
RECOVERY_KEY=$(/usr/bin/fdesetup showrecoverykey | /usr/bin/grep "Recovery Key" | /usr/bin/awk '{print $3}')

# Send to Jamf Pro via API
curl -X POST \
  -H "Authorization: Bearer ${JAMF_API_TOKEN}" \
  -H "Content-Type: application/json" \
  -d "{\"device_id\": \"${DEVICE_ID}\", \"recovery_key\": \"${RECOVERY_KEY}\"}" \
  "https://${JAMF_INSTANCE}.jamfcloud.com/api/v1/encrypted-recovery-key"

Escrow with Kandji

Kandji automatically handles recovery key escrow when devices check in. No additional configuration required.

# Verify escrow status
kandji device get --device-id <DEVICE_ID> | grep -A 5 "filevault"

User Communication and Rollout Strategy

Successful FileVault enforcement requires careful communication with remote team members.

Pre-Rollout Communication Template

Subject: Upcoming Security Update: Disk Encryption Required for Your Mac

Hi [Team Member],

As part of our commitment to protecting company data on remote work devices, 
we're enabling FileVault disk encryption on all company Mac laptops.

What you need to know:
- Encryption will be pushed remotely via our MDM system
- You'll receive a notification to restart your Mac
- Your Mac must be plugged in during the encryption process
- Initial encryption takes 2-4 hours depending on disk size
- Your login password will become your FileVault password

Before the update:
1. Save all open work
2. Ensure your Mac is plugged in
3. Connect to stable internet

If you have questions, contact [IT Support Email].

Thanks for helping us keep our data secure!

Handling User Resistance

Some users may resist encryption due to concerns about performance or complexity:

Performance: FileVault has minimal performance impact on modern Macs with T2 chips or Apple Silicon
Privacy: Emphasize that IT cannot access personal files—only recovery keys for locked devices
Flexibility: Allow users to choose when to initiate the encryption within a reasonable window

Enforcement Workflow for Remote Devices

Automated Enforcement via MDM

// Example: MDM Enforcement Logic
async function enforceFileVault(device) {
  const encryptionStatus = await checkFileVaultStatus(device.id);
  
  if (!encryptionStatus.enabled) {
    // Send reminder to user
    await sendNotification(device.userId, {
      title: "Security Update Required",
      message: "Please enable FileVault on your Mac to comply with security policy.",
      action: "Enable FileVault",
      deadline: "48 hours"
    });
    
    // If still not enabled after deadline, force via MDM
    if (!encryptionStatus.enabled && Date.now() > deadline) {
      await pushFileVaultProfile(device.id);
    }
  }
  
  // Log compliance status
  await logComplianceEvent(device.id, "filevault", encryptionStatus.enabled);
}

Manual Enforcement for Non-Compliant Devices

For devices that don’t receive MDM profiles correctly:

#!/bin/bash
# Manual FileVault enablement script (run as user with admin privileges)

# Check current status
/usr/bin/fdesetup status

# Enable FileVault with institutional recovery key
/usr/bin/fdesetup enable -user <admin_user> -institutionalRecoveryKey /path/to/recovery_key.plist

# Verify enablement
/usr/bin/fdesetup status

Monitoring and Compliance Reporting

MDM Compliance Dashboard Queries

// Jamf Pro Smart Group for Non-Compliant Devices
{
  "name": "FileVault Not Compliant",
  "criteria": [
    {
      "field": "FileVault",
      "operator": "is",
      "value": "Not Encrypted"
    }
  ],
  "site": "Remote Work"
}

// Kandji Compliance Report
kandji report compliance --category filevault --format csv

Weekly Compliance Script

#!/usr/bin/env python3
# FileVault Compliance Reporter

import subprocess
import json
from datetime import datetime

def check_filevault_status():
    """Check FileVault status on managed Macs"""
    cmd = ["profiles", "status", "-type", "encryption"]
    result = subprocess.run(cmd, capture_output=True, text=True)
    return "FileVault is On" in result.stdout

def generate_report():
    devices = get_managed_devices()
    compliant = sum(1 for d in devices if check_filevault_status(d))
    total = len(devices)
    
    report = {
        "date": datetime.now().isoformat(),
        "total_devices": total,
        "compliant_devices": compliant,
        "compliance_rate": round(compliant/total * 100, 2)
    }
    
    print(f"FileVault Compliance: {report['compliance_rate']}%")
    print(f"Compliant: {compliant}/{total}")
    
    return report

Troubleshooting Common Issues

Encryption Stuck at 0%

This typically indicates insufficient disk space or corrupted preferences:

# Clear FileVault preferences and retry
sudo rm -rf /Library/Preferences/com.apple.FileVault.plist
sudo rm -rf /var/db/FileVault/

# Restart and re-enable via MDM
sudo shutdown -r now

User Can’t Remember Password

If a user forgets their FileVault password and no recovery key was escrowed:

Contact IT support immediately
If institutional recovery key was escrowed, IT can provide
Otherwise, data recovery requires Apple Store visit with proof of ownership

MDM Profile Not Installing

Common causes and solutions:

APNs issues: Verify APNs certificate is valid
Device not enrolled: Check Device Enrollment Program status
Profile conflicts: Remove existing conflicting profiles

# Check MDM enrollment status
sudo profiles status -type enrollment

Built by theluckystrike — More at zovo.one