From a8e021234208403dba8e60a43b28f35b29554e5b Mon Sep 17 00:00:00 2001
From: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Date: Fri, 15 May 2026 09:03:50 -0400
Subject: [PATCH] Disk encryption guide: Clarify when escrow happens for macOS
 (#45412)

Context:
https://fleetdm.slack.com/archives/C09HG9VMRSS/p1778612106854329
---
 articles/enforce-disk-encryption.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/articles/enforce-disk-encryption.md b/articles/enforce-disk-encryption.md
index 2b7f1603c5..229b3f545d 100644
--- a/articles/enforce-disk-encryption.md
+++ b/articles/enforce-disk-encryption.md
@@ -8,7 +8,7 @@ In Fleet, you can enforce disk encryption for your macOS and Windows hosts, and
 
 When disk encryption is enforced, hosts' disk encryption keys will be stored in Fleet.
 
-For macOS hosts that automatically enroll, end users are forced to enable disk encryption during Setup Assistant. For hosts that manually enroll, end users are forced to enable disk encryption the next time they log out and log back in. For both enroll methods, end users can't defer. 
+For macOS hosts that automatically enroll, end users are forced to enable disk encryption during Setup Assistant and the disk encryption key is automatically escrowed to Fleet. For hosts that manually enroll, end users are forced to enable disk encryption. The key gets escrowed the next time they log out and log back in. For both enroll methods, end users can't defer. 
 
 For Windows, currently disk encryption is enforced on the C: volume (default system/OS drive) only on hosts with a [TPM chip](https://support.microsoft.com/en-us/topic/what-s-a-trusted-platform-module-tpm-705f241d-025d-4470-80c5-4feeb24fa1ee). For Linux, encryption requires end user interaction.