I just found the solution for your issue (a bit late but could be helpfull for somebody else )
The reason why you get that message in the activity log on the user interface is one of the following:
- The machine is with disabled "Boot protection" in the admin console.
- There are no drives selected to be encrypted in the admin console.
- No user is assigned to machine in question.
Fixig that helped in my case and I were able to perferm the encryption.