POA screen don't appear after the second reboot .

Question

Heloo everybody, 
 i installed sophos safeguard version 8.10 , all components are installed correctly. 
 i configure two policy (device encryption) and (Bitlocker POA : for the authentication of the bios when the computer start) , when i installed the sophos client the installation has succedded , the pc start to encypt the disk at the first reboot but the problem is the screen POA don't appear to configure password for the authetication and the PC's will authenticate at the startup. 
 i configured this setup many time in the past and it work correctly so i am sure about the parametres of the setup. 
 the OS client is windows 10 pro 
 PC are lenevo

thank you for your help

MichaelMcLannahan · Answer

Thanks for that screenshot, that helps a lot! 
 
 What you have configured is 
 
 1 - TPM ONLY for PC's with TPM (most business laptops/PC's) - That is to say you will NOT see an additional prompt - The data is secured by the internal module. 
 2 - Fallback mode (for PC's that DON'T have TPM (or a TPM that's disabled) is configured for password. So IF a PC doesn't have TPM (which your laptop sounds like it DOES) you will be asked for a password instead of the TPM module. 
 
 It HAS authenticated - but rather than asking for a PIN/password, it confirmed the authenticity with the internal TPM chip. You can add to this security by ALSO adding a PIN to this stage. 
 
 What you need to do for this laptop if you want to see a additional prompt (which I would strongly recommend) then you need to change that first policy to TPM+PIN. You don't need to change the second part - password for fallback mode is correct for most scenarios. 
 
 The PIN doesn't HAVE to be digits, it could be a passphrase if you wanted but personally I would encourage users to use NUMBERS for a PIN and characters for a PASSWORD/PHRASE