BitLocker recovery key escrow in Azure AD

Overview

BitLocker keys must be escrowed to avoid permanent data loss. For Entra ID–joined devices, keys can be stored in Azure AD / Intune so authorized admins can recover them.

Preconditions

• TPM present and enabled; firmware up to date on modern devices.
• Device join type supports escrow (AAD join or hybrid with proper automatic registration).
• License includes required features (Azure AD Premium / Intune-dependent scenarios per Microsoft guidance).

Deployment recipe

1. Enable BitLocker silently via Endpoint protection profile or PowerShell script with protector types TPM + Recovery password.
2. Force BackupToAAD-BitLockerKeyProtector after encryption begins (Intune remediations or scripted).
3. Validate in Entra ID Devices > BitLocker keys (RBAC required).

Operational use of recovery keys

• Use least privilege: only security/admin roles may read keys; log access.
• Never email keys in clear text; use secure handoff or guided user self-service where available.
• After recovery, rotate protectors if compromise is suspected.

Troubleshooting

• Hybrid devices not showing keys: check Automatic-Device-Join and AAD Connect/device sync health.
• BIOS updates may suspend BitLocker—plan suspend/resume scripts.

Client communication

Explain that escrow is mandatory for supportability and that keys are protected by Microsoft’s identity controls and your RBAC model.