> For the complete documentation index, see [llms.txt](https://docs.intunemacadmins.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.intunemacadmins.com/filevault/enable-filevault-in-setup-assistant.md).

# Enable FileVault in Setup Assistant

Step-by-step guide on enabling FileVault during macOS Setup Assistant using Intune. Learn about prerequisites, configuration profiles, and best practices.

## Prerequisites

Before we start with the FileVault configuration profile in Intune, we have to complete following requirements:

1. Enable Await Final Configuration
   1. Follow the guide here to enable it: [Configure Await Final Configuration](/await-final-configuration/configure-await-final-configuration.md)
2. Create a Filter using the EnrollmentProfileName
   1. Follow the guide below to create the filter.

**Create a Filter using the EnrollmentProfileName**

1. Go to the [Intune Portal](https://intune.microsoft.com) and sign in.
2. Go to the Tenant Administration -> Filters -> Create -> Managed Devices
3. Give this filter a name and select macOS as the platform.
4. Now on the Rules page, select
   1. Property = EnrollmentProfileName,
   2. Operator = Equals
   3. Value is the Name of your Enrollment Profile that you can find here: [Enrollment program tokens](https://intune.microsoft.com/#view/Microsoft_Intune_Enrollment/DepTokensPagingBlade) and then select your Token to see your Enrollment Profile. If you do not have a Profile, you have to create one or else the whole Deployment and Enrollment for your macOS Devices will not work.
5. Here is an example of how it could look like: ![Intune Device Filter](https://3465854426-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU9BWB4smfcOeIGFw7Awl%2Fuploads%2Fgit-blob-784595ca8307f4f54cecd0cf7c4789c362816766%2FFileVault_1.png?alt=media)

{% hint style="success" %}
Generally speaking, using a Device Filter instead of assigning your policies to a dynamic group is much faster, because Intune does not need to sync with EntraID and evaluate which devices are in the dynamic group and which are not. With the help of the above Filter, Intune knows the devices because it just checks its own inventory instead of connecting with EntraID. Only this way, your policies will arrive on a device that is in the Setup Assistant fast enough to be enabled or configured.
{% endhint %}

## Configration Profile

If you have Await Final Configuration enabled and also have created a Device Filter you are ready to create your FileVault Configration.

You can either download and import the Configuration Profile from here: [Enable FileVault during Setup Assistant](https://github.com/ugurkocde/intunemacadmins/tree/main/content/.gitbook/assets/FileVault/Enable_FileVault_during_Setup_Assistant.json)

or create your own profile following this guide:

1. Go to the [Intune Portal](https://intune.microsoft.com) and sign in.
2. Go to Devices -> By platform -> macOS -> Manage devices -> Configuration and Create a new policy.
   1. Profile type: Settings catalog
3. Give it a descriptive name and click on Next. Example: *Enable FileVault during Setup Assistant*
4. Click on Add settings and navigate to Full Disk Encryption. ![FileVault](https://3465854426-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU9BWB4smfcOeIGFw7Awl%2Fuploads%2Fgit-blob-8e295ff7681e2108c9a399f414def9038dab765b%2FFileVault_2.png?alt=media)
5. Select *Force Enable in Setup Assistant* (this will automatically select *Enable*)
6. Let´s also configure *Prevent FileVault From Being Disabled*. You can find it in the *FileVault Options* category. ![FileVault](https://3465854426-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU9BWB4smfcOeIGFw7Awl%2Fuploads%2Fgit-blob-d6cb3df10d91bf335ec258005b306a1b07f5bab8%2FFileVault_3.png?alt=media)
7. Let´s configure the settings after adding them to the profile:
   1. Force Enable In Setup Assistant = True
   2. Enable = On
   3. Prevent FileVault From Being Disabled = True
8. After assigning and saving the profile, the settings should like the following: ![FileVault](https://3465854426-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU9BWB4smfcOeIGFw7Awl%2Fuploads%2Fgit-blob-ab4d2fbe3aff6daae7020df22bf7f9d4d8d45ec3%2FFileVault_4.png?alt=media)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.intunemacadmins.com/filevault/enable-filevault-in-setup-assistant.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.