For macOS devices, FileVault settings can appear greyed out when an MDM FileVault configuration profile is still applied to the device. To allow the user to disable FileVault locally, the FileVault policy must first be removed from the device.
If the policy is assigned through device groups, check all groups associated with the FileVault policy. If the device is targeted through a custom group, remove the device from that group. If it is targeted through a dynamic device group, add the device as an exception to the dynamic group criteria.
A typical workflow would be:
1. Go to Manage > Device Groups.
2. Open each device group associated with the FileVault policy.
3. If it is a dynamic group, add the affected Mac as an exception.
4. Save the group.
5. Run Sync Now or scan the device so the policy removal is reflected on the Mac.
6. Once the FileVault policy is removed, the user should be able to disable FileVault from macOS System Settings.
7. After FileVault is disabled, remove the exception from the dynamic group.
8. Save the group again and sync the device.
9. The FileVault policy will be pushed back to the Mac.
When FileVault is enabled again, ensure the policy is configured to escrow the recovery key so that the key is stored in the Hexnode portal.
Regards,
Mary Romero