Windows 11 comes with plenty of built-in security tools, but figuring out what each one does can be confusing. BitLocker protects stored data, passkeys secure supported account sign-ins, and Microsoft Defender watches for malware and suspicious activity.
Windows Hello, Windows Firewall, SmartScreen, memory integrity, and other safeguards provide additional protection. Availability can vary by hardware, Windows edition, account type, setup method, and organizational policy.
This cheat sheet outlines how each feature works and highlights the settings users should review.
Windows 11 security features at a glance
Windows 11 security works in layers rather than through one all-purpose feature. The table below shows what each major protection covers and the primary limitation users should understand before relying on it.
| Protection | What it does | Main limitation |
|---|---|---|
| BitLocker and Device Encryption | Encrypt data stored on internal drives | Availability and controls depend on the Windows edition, hardware, and configuration |
| Passkeys | Replace passwords for supported accounts, apps, and websites | The account provider, app, or organization must support passkeys |
| Windows Hello | Verifies the user and unlocks device-bound credentials | Face and fingerprint options require compatible hardware |
| Microsoft Defender Antivirus | Detects malware, potentially unwanted apps, and suspicious behavior | Enterprise investigation and response features are separate |
What is BitLocker?
According to Microsoft’s BitLocker documentation, the feature encrypts entire volumes and can use the Trusted Platform Module, or TPM, to protect encryption keys and verify the startup environment.
Encryption can reduce data exposure when a computer is lost, stolen, improperly retired, or accessed while Windows is offline. BitLocker can protect the Windows operating system drive, fixed data drives, and removable storage through BitLocker To Go.
Organizations can also require a PIN or startup key before BitLocker releases the encryption key. Encryption does not protect files after an authorized user has signed in, so account security and software updates still matter.
Is BitLocker available on Windows 11 Home?
Full BitLocker enablement is available on Windows 11 Pro, Enterprise, Pro Education, and Education. Eligible Windows 11 Home devices may instead offer Device Encryption, which uses BitLocker technology with a simpler setup.
Windows 11 version 24H2 expanded Device Encryption eligibility by removing some earlier hardware requirements. Availability still depends on the device, installation, account setup, and Windows edition.
Users can check Settings > Privacy & security > Device encryption. On supported editions, searching for Manage BitLocker opens the full management interface.
Where should you save a BitLocker recovery key?
A BitLocker recovery key restores access when a protected drive cannot unlock normally. Windows may request it after certain boot, TPM, firmware, authentication, or hardware changes.
Several storage options are available for recovery information. Depending on the device and organizational policy, the key may be saved to a Microsoft account, Microsoft Entra ID, Active Directory Domain Services, a text file, or a printed copy.
A BitLocker recovery key is commonly provided as a unique 48-digit number associated with the protected drive.
Keep the recovery information separate from the protected computer. Saving the only copy on the encrypted drive defeats its purpose.
Before changing TPM, firmware, boot, or storage settings, confirm whether encryption is active and locate the matching recovery key. IT teams should follow their organization’s change-management process before altering a managed device.
What are passkeys?
Microsoft describes passkeys as a passwordless sign-in method based on public-key cryptography. The device or credential provider protects a private key, while the account service stores the corresponding public key.
A website does not receive a reusable secret that an attacker can steal and enter elsewhere. Passkeys therefore reduce the risks associated with password reuse, credential stuffing, conventional phishing, and compromised password databases.
Windows can store passkeys through Windows Hello or use a supported credential manager, physical security key, phone, or tablet. The website, application, or account provider must support passkey authentication before the user can adopt it.
Recent Windows 11 releases added native passkey management and consent controls for applications requesting access to stored passkeys. Users can manage them under Settings > Accounts > Passkeys.
Work and school support may also depend on Microsoft Entra policies and the organization’s authentication configuration.
How are passkeys different from Windows Hello?
A passkey authenticates someone to a supported account, website, or application. Windows Hello verifies the person using a Windows device through a PIN, fingerprint, or facial recognition.
Windows Hello can protect and unlock a passkey stored on the computer. The Windows Hello PIN is tied to that device and works with protected credentials, so it is not simply a shorter version of the user’s Microsoft account password.
Windows Hello for Business adds administrative and policy controls for organizational identities, while standard Windows Hello primarily verifies a user on an individual device.
What does Microsoft Defender protect?
Microsoft’s Defender documentation says the built-in antivirus uses real-time scanning, behavior monitoring, cloud-delivered protection, and security intelligence updates to identify malware, potentially unwanted apps, and other threats.
Microsoft Defender includes several related security tools. Windows Security is the dashboard for viewing and managing protection settings, while Microsoft Defender Antivirus scans the device for malware and other threats.
Microsoft Defender SmartScreen checks website, download, and application reputation. Microsoft Defender for Endpoint adds separately licensed enterprise management, investigation, and response capabilities.
Windows 11 also includes tamper protection, which helps prevent malicious software from changing important Defender settings. Controlled Folder Access can limit unauthorized changes to protected folders.
Is Microsoft Defender enough?
Microsoft Defender Antivirus provides a useful security baseline for Windows 11, but whether it is enough depends on the device, user behavior, business risk, and regulatory requirements.
Businesses may still require centralized management, endpoint detection and response, compliance reporting, or other enterprise capabilities.
When a compatible third-party antivirus product is installed, activated, and registered with Windows, Defender Antivirus generally turns off automatically. Removing the other product allows Defender to turn back on.
Which other Windows 11 protections matter?
BitLocker, passkeys, and Defender do not work alone. Windows 11 also includes network, application, driver, and startup protections.
| Protection | What it protects | What to know |
|---|---|---|
| Windows Firewall | Network traffic | Blocks unsolicited inbound connections by default; use targeted rules instead of disabling it |
| Microsoft Defender SmartScreen | Websites, downloads, and apps | Warns about phishing, malware, and low-reputation content |
| Memory integrity | Windows kernel and drivers | Helps block vulnerable drivers but may conflict with older hardware or software |
| Smart App Control | Executable files and apps | Can block malicious, potentially unwanted, or untrusted unsigned software; availability varies |
| Secure Boot and TPM | Startup and cryptographic keys | Support protections such as BitLocker and Windows Hello |
Which Windows 11 security settings should you check?
The following checklist can help users identify missing protections or settings that need attention.
- Open Windows Security and resolve active warnings.
- Confirm whether BitLocker or Device Encryption is enabled.
- Locate and securely store the BitLocker recovery key.
- Add passkeys to supported high-value accounts.
- Check Windows Firewall and memory integrity settings.
- Install Windows, browser, application, driver, and security updates.
Frequently asked questions
Is BitLocker available on Windows 11 Home?
Eligible Windows 11 Home devices may offer Device Encryption, while full BitLocker management is available on supported Pro, Enterprise, and Education editions.
Can BitLocker work without a TPM?
Yes. Windows can be configured to use BitLocker without a compatible TPM, but the authentication setup and startup-integrity protections differ.
A TPM-free configuration does not provide the same preboot system-integrity verification.
Are passkeys safer than passwords?
Passkeys reduce exposure to password reuse, credential stuffing, and conventional phishing because the account service does not store the private key.
Device security and dependable account-recovery methods still matter.
Is a Windows Hello PIN the same as a password?
No. A Windows Hello PIN is tied to the specific device and works with credentials protected by that computer. It is not reused like a conventional account password.
Does another antivirus disable Microsoft Defender?
A registered, active third-party antivirus product generally causes Defender Antivirus to turn off. Defender can turn back on after the other product is removed.
Bottom line: Windows 11 security works best in layers
BitLocker protects data stored on a drive, passkeys reduce reliance on reusable passwords, and Microsoft Defender monitors for malware and suspicious activity.
Windows Firewall, SmartScreen, memory integrity, Smart App Control, Secure Boot, and TPM provide additional network, application, driver, and startup defenses. Users should still confirm that the appropriate protections are available, enabled, up to date, and properly configured.
Read next: Find out what Windows 11 24H2 users should do before support ends in October.
