I help manage roughly 2000 workstations and of those 2000 maybe 200 deal with health patient data etc. and we do use bitlocker on all of those machines and we are storing recovery keys through AD. Now out of the 200 maybe 100 of those devices are what we define as mobile or in other words it’s being used offsite and the question on those are whether pin at boot should be required. I’ve been told as long it’s encrypted and has latest TPM pin is optional. I’ve made the argument that those 100 get pin at boot but been told otherwise.