Customer HubFileVault
With the FileVault configuration for macOS devices, full-disk encryption is enabled centrally on managed Macs.
Installing the FileVault configuration does not start disk encryption immediately. Encryption only begins the next time the affected user logs out and back in, since FileVault derives its encryption key from the user's login password.
Deployment via Automated Device Enrollment (DEP)
The FileVault configuration can be deployed via Automated Device Enrollment (DEP) before or during Setup Assistant, so it is already present when the device starts up for the first time. Since deriving the encryption key requires a user account and its login password, actual encryption cannot begin until after a user account has been created and that user has logged in for the first time.