What is BitLocker?
BitLocker is the full-disk encryption built into Windows Pro, Enterprise and Server editions. It encrypts the whole volume so a lost or stolen machine's data is unreadable, and on TPM machines it unlocks transparently at boot, so users rarely know it is there. The recovery key, generated at enablement, is the only way in when the TPM measurements change; escrowing it (AD, Entra ID, or your RMM) is the part people regret skipping.
What it does and does not protect
BitLocker protects data at rest: the laptop left on a train, the drive pulled from a decommissioned PC. Once Windows is booted and unlocked it does nothing against malware or a logged-in attacker, and it is not a backup; ransomware encrypts a BitLocker drive as happily as any other.
Fleet notes
Windows Home has a reduced "device encryption" variant with the same engine and fewer controls. Check status fleet-wide with Get-BitLockerVolume, and treat "encrypted but protection off" as unprotected: that state is common after suspended protectors and firmware work.