Unencrypted Assets
Automated detection of devices without full-disk encryption with compliance enforcement workflows.
- Runs periodic scans for devices without full-disk encryption
- Cross-references device inventory against encryption policy requirements
- Distinguishes newly flagged devices from those already being tracked
- Notifies device owners with the guidance needed to enable encryption
- Opens a compliance ticket for IT to remediate
- Auto-resolves once encryption is confirmed active
What Unencrypted Assets does
Unencrypted Assets is Harmony's automated monitoring workflow for identifying company-owned devices where disk encryption is disabled or in an unknown state. Running on a daily schedule, Harmony queries MDM-managed devices for missing or unconfirmed disk encryption, optionally notifies device owners directly to enable encryption, generates a CSV report, and creates an IT desk ticket with all affected devices. Unencrypted devices are a critical security and compliance risk - this workflow ensures IT knows about them immediately rather than discovering them during an audit or incident.
Who Unencrypted Assets Is For
IT security and operations teams responsible for endpoint encryption compliance.
Disk encryption (BitLocker, FileVault) policies are easy to configure but hard to audit at scale without tooling. A device where encryption failed to apply, was manually disabled, or was never configured can go undetected for months. Regulatory frameworks (HIPAA, SOC 2, ISO 27001) require encryption on all managed endpoints - this workflow creates the recurring compliance check that confirms coverage.
How Unencrypted Assets Works
A cron schedule fires (default: daily at 8 AM UTC). Schedule and timezone are configurable per tenant.
- Query unencrypted devices
The workflow queries MDM-managed, company-owned devices for those where disk encryption is not confirmed as enabled (either disabled or unknown encryption state).
- Owner notifications (optional)
If notifications are enabled, Harmony sends a direct message to each device owner notifying them that their disk encryption is not enabled, with a configurable frequency gate (default: once per 7 days per device). VIP employee exclusion is supported.
- Ticket filtering
Notification results are merged into the device records for the ticket CSV.
- CSV report
All unencrypted devices are serialized into a CSV report (
unencrypted_assets_report) including a "Last Notification" column.
A ticket titled "Devices With Unencrypted Disks Detected" is created in the IT desk with the CSV attached.
Capabilities
- Disk encryption status monitoring - Queries MDM-managed devices for those where disk encryption is disabled or not confirmed as enabled.
- Owner notifications - Optionally sends a Slack or Teams DM to the device owner notifying them that encryption is not enabled on their device, enabling self-service remediation.
- Notification frequency gate - Tracks when each owner was last notified and suppresses repeat messages within the configured window (default: 7 days per device).
- VIP employee exclusion - Configurable option to skip notifications for employees marked as VIP.
- CSV report with notification history - The IT ticket CSV includes a "Last Notification" column so IT can see which owners have been notified.
- Configurable schedule - Cron schedule and timezone are fully configurable per tenant (default: daily).
- Ticket toggle - Ticket creation can be independently disabled if only owner notifications are desired.
Main use cases
Daily Encryption Compliance Audit - IT security requires daily verification that all company laptops have BitLocker or FileVault enabled - a common requirement for HIPAA, SOC 2, and CIS Controls compliance. The daily workflow queries all MDM-managed devices for missing encryption, creates a ticket with the full CSV, and ensures IT has a fresh, dated record of any compliance gaps each morning.
Employee Self-Remediation - IT wants employees to enable encryption themselves without requiring IT to manually reach out to each one. With notifications enabled, the workflow sends the device owner a DM explaining that their device encryption is not enabled and what to do. Many employees can enable FileVault or BitLocker themselves, reducing IT's remediation workload.
Pre-Audit Compliance Verification - A security audit is coming up and IT needs to confirm that all managed devices have encryption enabled. The CSV report provides a current, structured list of all devices lacking confirmed encryption - audit-ready evidence of what was detected and when it was flagged.
Integrations
| Integration | Role in the agent flow |
|---|---|
| MDM / Device Management (internal) | Source of device encryption status - the MDM (Jamf, Intune, etc.) reports whether disk encryption is enabled per device |
| Asset Management API (internal) | Company-owned device records; the encryption status from MDM is read through this layer |
| Service Desk (internal) | IT ticket created with CSV; tracked for remediation |
| Notifications system (Slack/Teams) | Sends direct encryption warning to device owners when notifications are enabled |
FAQ
It's a scheduled Harmony workflow, not an interactive chatbot. It runs on a cron schedule (default: daily), queries MDM-managed device encryption status, and produces owner notifications and/or IT tickets based on what's found.
Meet more Agents
