Create or edit a configuration profile with the following information:

Create or edit the following script and configure it to run when the check fails:

SELECT 1 FROM bitlocker_info WHERE drive_letter='C:' AND protection_status=1;

$bitlockerInfo = Get-BitLockerVolume -MountPoint "C:"
if ($bitlockerInfo.ProtectionStatus -eq 1) {
    Write-Output 1
}