How to enable device encryption on a phone with Windows 10 Mobile

By Mauro Huculak
published

Preventing unauthorized access to your personal data on your mobile device should always be a top priority.

Windows 10 Mobile includes some security features, such as "Find My Phone" to quickly locate your phone in case it's lost or stolen, and Windows Hello to securely unlock your phone with your eyes using an Iris scanner. It also brings an extra layer of security that allows you to use BitLocker technology to encrypt the operating system and your files and folders that are stored locally on the phone.

In Windows 10 Mobile, the feature is called Device encryption, and it helps to make local device data unreadable for anyone who attempts to access it without authorization. The primary reason Microsoft is adding this feature is to protect your confidential data if your device is lost or stolen. Using the encryption feature only the person with the right encryption key (your password) can make files and folders readable.

Enabling Device encryption in Windows 10 Mobile

Device encryption is an option that comes disable by default, but you can easily enable the feature using the following steps:

  1. While in the Start screen, swipe left to bring All apps, then search for and open the Settings app, and tap on System.

  1. Next, tap on Device encryption.

  1. Finally, make sure to slide the Device encryption pill switch to the On position to enable the feature.

Important Note: A password PIN must be in place to enable the feature if your mobile device doesn't have one when trying to enable Device encryption, you will be automatically redirected to the Sign-in options settings page to create a PIN. Then you would just tap the Add button, under the PIN section, and follow the on-screen wizard to create a new PIN. After the PIN password is created, you can go back to Device encryption settings to verify that the feature has been enabled.

While the feature should work as expected, Windows Phone 8.1 used to display an "encrypted" label in the phone storage settings, and Windows 10 Mobile doesn't provide such visual confirmation in the storage settings. The only way to verify your device is being encrypted is by making sure the "Device encryption" is turned on in the Settings app.

It's important to point out that while encryption is enabled on your mobile device, the operating system and your data stored in the local storage will be encrypted, but device encryption will not encrypt data that you stored on an SD card. As such, it's highly recommended that you not save sensitive data on a removable storage, as anyone could easily remove the storage and have unrestricted access to that data from any computer.

Furthermore, you need to be careful when to choose to enable this feature, as it's possible that encrypting your device may cause some issues, such as problems with emails not synchronizing with your phone.

Are you using device encryption in your Windows 10 Mobile? Let us know in the comments below.

More resources

For more Windows 10 Mobile tips and tricks, and the latest news, you can visit the following resources:

Mauro Huculak
Mauro Huculak

Mauro Huculak is technical writer for WindowsCentral.com. His primary focus is to write comprehensive how-tos to help users get the most out of Windows 10 and its many related technologies. He has an IT background with professional certifications from Microsoft, Cisco, and CompTIA, and he's a recognized member of the Microsoft MVP community.

64 Comments
  • I thought I already had it on, but apparently not. Thanks!
  • Same here :/
  • What's the point?
    When they steal your phone, you can't lock it or track it's location.
    A new Microsoft account is authorised and replaces yours without any notification
  • Well you're already securing your device from being stolen by using a windows phone. :) hehe just a jab. But find my location works great as at least you know where you last had it before someone popped the battery. It would be better if phones had a cmos style battery for when they are off to at least be able to maintain GPS info when requested through portal. Though not sure if it could provide the amount of power required. Maybe 1 time use or something hehe.
  • Find my location is useless when your Microsoft account is replaced on the phone.
  • There is a reset protection available since Windows Phone 8.1 GDR2, thief wouldn't be able to replace account without first unlocking the device using old Microsoft account http://www.windowsphone.com/en-US/how-to/wp8/settings-and-personalizatio..., device would be locked by IMEI, this means even reflashing wouldn't help to unlock it.
  • I'm not sure if this option is available on windows 10 mobile yet.
  • At least this is what the FAQ says http://windows.microsoft.com/en-us/windows-10/security-privacy-mobile -> http://windows.microsoft.com/en-us/windows/protect-my-phone
  • It is. Since at least November.  
  • Its too not working... I did a reset of my phone and entered a new Microsoft account id(not the previous one) and it accepted without any error... Useless option it was that we'll have to enter our previous id....
  • Problem is, not all devices have received WP8.1 GDR2. From your link "Reset Protection is available only for some new phones running build 8.10.15127.138".   I own a 925 and a 930, and use a 720 for work, and none of them have received GDR2.
  • Lol good one.
  • "What's the point?" If my phone (or laptop) gets stolen, I have to report it to my Compliance department. They'll ask me if the device was encrypted, I'll be able to give them an honest answer when I say "Yes." As we like to say around the office: "If the company's name makes the news, we only want it to be for good reasons."
  • As Ap3rus said below "There is a reset protection available since Windows Phone 8.1 GDR2, thief wouldn't be able to replace account without first unlocking the device using old Microsoft account http://www.windowsphone.com/en-US/how-to/wp8/settings-and-personalizatio..., device would be locked by IMEI, this means even reflashing wouldn't help to unlock it."
  • Device enryption still prevets anyone from accessing the files you have on there, like contacts, pictures, documets etc. The thief would have to wipe the phone to use it.
  • ThaNX!
  • When's windows 10 mobile coming out tho ?
  • 32nd Jan Bro By MS
  • lol lies. they said -2 of januvember. please stop speading fud, troll :)
  • Coming Soon...
  • It's out now, you can pick up a 950 or 950 XL in your local MSFT store. Or maybe the 550, but idk where.
  • I had tried this once for just 5 seconds, ON and OFFed it! and when i updated to a newer build, i got a BitLocker screen and i could not use the phone until i used WDRT! I remember it was OFF when i started the update.
  • Right, so if you're an Insider, or doing a reset, be sure to turn OFF Encryption or be looped and you have to Recover the device in the process. Which is trickier when in this loop.. =\
  • I haven't had such problems. Encryption on right after unboxing and updated twice (once for wXm and once for firmware) no loops
  • I don't see this option in 8.1 !
    There is nothing to 'enable' it because its already enabled.
  • Not true. You need to use Intune or alike to set encryption on.
  • I didn't know this was a thing, very interesting!
  • After I enabled the encryption, my phone keeps asking me to enter the password of my Microsoft account every few days (including enter the code they sent to my phone num). It's so annoying. It doesn't happen if I switched the encryption off.
  • Thanks for this!  As a side note, it would be neat if/when MS starts to utilize the Windows Hello (where applicable).  Would have been cool if instead of using the PIN to enable this feature, it asked to scan my iris. 
  • It should....you need to have them set up beforehand.
  • if you set a password on onedrive it will scan your iris. Though the dialog is really low so it forces your eyes to look down. I think ms needs the animation up high near the logo like at login.
  • Lol
  • When I was using 10 in my L720, I had turned it ON. Little did I know if the phone was made to reset, it would get stuck with blue screen with bitlocker needs key to access the drive.
  • same thing for PC too. normally they would automactic key backup on onedrive, but sometimes the key just simply refuse to work.
  • Its like phone lock in 8.1. Whats the difference or new abt it....and what is the use if, it encrypts only phone memory. How much data, one can store in phone when 8 gb memory has other sharholders like OS and apps which already consumes lot of space.
  • Exactly. There is no use just encrypting phone storage. All photos and other personal stuff will be stored in memory card. Old feature phone has the option to lock memory cards and having smartphone in hand we don't have it. I remember there was an app on my Nokia N79 which encrypts and backup your call logs, messages, etc. If the sim is changed the phone gets locked and the new sim number is sms to the owner and if internet is connected the location also can be traced by king into the website. So this works without internet connection also, whereas MS find my phone works only if internet is there. Now that app is acquired by McAfee. They have it for all platform except windows.
  • It would be nice if you could just encrypt certain directories as not sure if full encryption would cause performance to suffer. Does it encrypt OS files? Does it encrypt app/game files?
  • I had it on build 10586.29 and after installing build .36
    I reset my phone for a fresh restart but it took me to bitlocker recovery page asking for pin where you can't input pin as there's no options for that it was all mess, didn't knew then it was because device encryption was enabled just thinking i had bricked my 8 months phone.. . now i'm using 8.1 and will wait for official release. Hi I'm Lumia 730 not getting update when released.
  • I had the same problem on a brand new lumia 950xl.  I did a phone reset (I am not on the Insider Programme) from the options and the next thing I know is that the screen turned blue and that there was a bitlocker message saying that the TPM is untrusted etc.  The blue screen was configured for computer use because it told me to press the Enter key, ESC key or Windows key to continue.....obviously all useless options on a phone.  I had to recover the phone by using the Recovery Tool on my PC.  This freaked me out....immagine a brand new phone doing this!  
  • Wow. I have a 950 as well and not sure if i want to turn FDE on now. Did you do exactly as the above guide told on how to enable this feature ? and it still wrecked your phone ? :/ did you have PIN/Windows Hello set up?
  • I guess I won't be turning it on. Looks too serious thing for me to handle. I think PIN and find my phone options are enough for me.
  • Does it impact the phone's performance? Is it slowing down?
  • Can't notice anything of that on my phone.
  • The impact should be very minimal to none. However, I personally don't see my phone slow at all. Thanks,
  • I wondered the same. IIRC, Anandtech's review of the Nexus 5X noted that device encryption had a noticeable impact on performance. Note: I have zero idea how implementation varies between W10m and Android.
  • It should slow the device down.  But you won't notice it.  A lot of things that slow down Android devices you'll never experience on Windows Phone, because of how Windows Phone works.
  • It's useful if someone is going to hook to the board and dump the content of the memory, otherwise the pin is enough
  • I'd like to see a Mobile Nations story that compares encryption on iOS, Android and W10M.
  • Hi guys I am facing a problem in my phone ,I want to update to windows 10 so I downloaded windows insider after download insider app i select fastring then i check for update it shows windows 100586.29 i thought i will download it at night at night i i heard new build update 586.63 but in my phone i shows to download build29 there is no option fo recheck the update so how to recheck update in windows 8.1 Lumia 535
  • Not totally sure what you're asking, but here is my guess. You downloaded the Windows Insider app, selected fast ring, downloaded and installed an update, and now you aren't seeing the latest update you read about online. Your phone will download an update if there is one. Some times I've reselected fast ring from the Insider app, restarted the phone, and then another update was available.  Hope that helps.
  • i would really be careful on this, I did that to my old surface once, then one day I just can't open anything anymore, even when i enter the deencryption key, it still not be able to open them. which force me to had to put everything to the one drive cloud, and reinstall the system and download those files back locally.
  • Furthermore, you need to be careful when to choose to enable this feature, as it's possible that encrypting your device may cause some issues, such as problems with emails not synchronizing with your phone.   Sounds like Microsoft should fix some ******* bugs before they start on the next big update.  
  • my employer requires it to connect, to sync email & calendar. never had any issues with it, but I'm still on 8.1. interesting point about memory card (obvious maybe), need to double check what I'm saving locally but keep most stuff on OneDrive anyway.
  • Hmmm so having encryption enabled could be why my emails aren't syncing properly. There are emails I delete on my phone that aren't deleted from Gmail even days later. It's annoying to have to keep checking to make sure it did what it's supposed to.  Does anyone know of another good, reliable email app?
  • BTW, where is Reset Protection on our beloved 950/XL ?
  • According to http://windows.microsoft.com/en-us/windows/protect-my-phone , you activate it by going into find my phone settings, but there is nothing there. I also checked with my IMEI to see if Reset Protection is ON, but it was off, you can check at https://account.microsoft.com/devices/resetprotection. This is a very important security feature, there is no logic to be absent in the latest lumia models.    
  • All you need to do to enable is go to  Settings  > Updates & security > Find my phone and just enable the feature. I have 950 and it was enabled by default. My only issue is when i go to https://account.microsoft.com/devices/resetprotection and search for