BitLocker Recovery Key Not in Azure AD

ℹ️

What's happening: Intune requires a BitLocker policy to trigger key escrow. If the device encrypted before policy applied, or the policy is misconfigured, the key won't appear in Azure AD / Entra ID.

Diagnosis

Check Current Encryption & Escrow Status

# Check if drive is encrypted:
manage-bde -status C:

# Check if key is backed up to Azure AD:
(Get-BitLockerVolume -MountPoint C).KeyProtector |
  Where-Object {$_.KeyProtectorType -eq 'RecoveryPassword'}

Fix 1

Force Escrow of Existing Key

If the drive is already encrypted but the key isn't in Azure AD, trigger escrow manually.

$KeyId = (Get-BitLockerVolume -MountPoint "C:").KeyProtector |
           Where-Object {$_.KeyProtectorType -eq 'RecoveryPassword'} |
           Select-Object -ExpandProperty KeyProtectorId
BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $KeyId

Fix 2

Create or Fix the Intune BitLocker Policy

Go to Endpoint security → Disk encryption → Create policy → Windows → BitLocker and verify these settings:

→

Require device encryption

Yes

→

BitLocker recovery information to Azure AD

Recovery passwords and key packages

→

Enable recovery information storage in Azure AD before BitLocker

Yes (critical — prevents encryption without escrow)

BitLocker Recovery Key Not Found in Azure AD