Why is bitlocker so much more finicky than other platform?

At work, I notice when I login and notice that bitlocker encryption has been disabled. The issue eventually went away after a few reboot. At home, the computer prompted for the Bitlocker recovery key a few times. Mac OS, ChromeOS, Android, and iOS all have encryption on by default, but none of reported temporary encryption failures or prompt me for a recovery key. Why is bitlocker so finicky?

By design Bitlocker is heavily tied to TPM and can appear to be disabled if a TPM attestation fails in which case TPM will suspend BL until you reboot. In Enterprise environments Intune compliance checks can also temporarily disable BL.

If TPM detects any change in its measured components,TPM will not unseal the key so the user has to provide a recovery key. Some of those measured components that can trigger a recovery key are:

• BIOS/UEFI updates
• Secure Boot certificate changes
• Bootloader updates (Windows cumulative updates can modify this)
• Changing SATA/RAID/Intel RST modes
• Enabling/disabling virtualization features
• Firmware bugs on OEM systems
• TPM firmware updates or resets

Those other platforms you mentioned do not have this level of TPM integration so you never see the request for a recovery key.

Windows is also very sensitive to boot path integrity. Changes like dual booting, adding drives, docking and undocking or even having usb drives connected at boot can trigger a recovery prompt.

BitLocker can be suspended for a planned number of reboots, while security updates are pushed to Windows or your UEFI. Otherwise you would be forced to sit there and enter a recovery PIN, or provide a recovery drive.

Because the security updates introduce a change to the secure environment, TPM attestation fails and BitLocker assumes the system cannot be trusted. And asks you to reconfirm by providing a recovery key. By temporarily suspending it, the planned update can be automated.

Just to expand on the comments already made, if you suspend BitLocker via the GUI, that applies for one boot cycle. In other words, BitLocker will be suspended until the next time you boot into Windows.

If you want to suspend BitLocker for a specific number of boots, issue the command below. Note that in this example I am suspending BitLocker for 2 boots. So, once I've booted Windows twice, BitLocker will resume normal operation.

manage-bde -protectors -disable C: -RebootCount 2

If you want to resume BitLocker protection prior to reaching the reboot count that you specified in the above command, issue this command:

manage-bde -protectors -enable C:

This will re-enable BitLocker protection immediately regardless of how many reboot counts were specified.