BitLocker recovery keys in Intune, Entra ID and AD DS

To unlock a device stuck at the BitLocker recovery screen, read the recovery key ID from that screen. Then look up the matching 48-digit recovery password. For Microsoft Entra joined or hybrid joined devices managed by Intune, it’s in the Intune admin center under Devices > All devices > device > Recovery keys. For domain-joined devices that back up to AD DS, it’s in the computer object’s BitLocker recovery information. After the device is unlocked, rotate the password so the one you just disclosed stops working.

This is the how-to for storing, finding, and rotating keys. If the key is missing from Intune and Entra ID when you go looking, that’s an escrow failure. Use Fix Intune BitLocker recovery key escrow failures instead.

What you’re looking for

Microsoft’s BitLocker recovery overview names three kinds of recovery information:

Item	What it is
Recovery password	A 48-digit number that unlocks a volume in recovery mode. This is what the help desk reads to the user.
Recovery key	An encryption key on removable media, in a file named <protector_id>.bek.
Key package	Used with the BitLocker Repair tool (repair-bde.exe) to recover data from a damaged drive.

A device can have more than one recovery password. The recovery key ID on the preboot screen tells you which one to use.

Where keys are stored

Microsoft recommends one backup location per join type:

• Microsoft Entra joined devices: Microsoft Entra ID. Microsoft’s guidance on rotation and escrow also covers hybrid joined devices.
• Active Directory joined devices: AD DS. Each recovery password is stored in an ms-FVE-RecoveryInformation child object of the computer object. Old passwords aren’t removed until the computer object is deleted.
• Personal devices with a Microsoft account (not domain or Entra joined): the user’s Microsoft account is the default recommended location.

Configure backup before you encrypt. For Intune-managed devices, the BitLocker policy settings to look for are Save BitLocker recovery information to Microsoft Entra ID and Store recovery information in Microsoft Entra ID before enabling BitLocker (Intune BitLocker article). The second setting stops encryption from starting until the backup succeeds. If you can only fix one thing, fix that.

One limit to know: Microsoft Entra ID stores at most 200 BitLocker recovery keys per device. Once a device hits that limit, silent encryption fails because the key backup fails first.

Find a key as an admin

Intune admin center

1. Go to Devices > All devices and select the device.
2. Under Monitor, select Recovery keys.
3. Select Show Recovery Key. The view lists the BitLocker Key ID, the recovery key, and the drive type. Each reveal creates an audit log entry under KeyManagement.

If Intune shows No BitLocker key found for this device, the key isn’t in Entra ID. Go to the escrow troubleshooting article.

To read keys, you need the microsoft.directory/bitlockerKeys/key/read permission. Microsoft lists Cloud Device Administrator, Helpdesk Administrator, and Global Administrator as roles that include it. Every recovery key access is audited.

Microsoft Entra admin center

The Entra device management article covers viewing and copying keys from the device’s page in the Microsoft Entra admin center. It’s useful for Entra joined devices that aren’t enrolled in Intune.

Microsoft Graph PowerShell

Get-MgInformationProtectionBitlockerRecoveryKey doesn’t return the key itself by default. You have to request the key property, and doing so writes an Entra audit log entry. The least-privileged Graph permission that returns metadata is BitlockerKey.ReadBasic.All. Reading the key needs BitlockerKey.Read.All. This is a trimmed version of Microsoft’s example from the recovery process article:

Connect-MgGraph -Scopes "BitlockerKey.Read.All","Device.Read.All"
$DeviceId = (Get-MgDevice -Filter "displayName eq 'PC-0042'").DeviceId
$KeyIds = (Get-MgInformationProtectionBitlockerRecoveryKey -Filter "deviceId eq '$DeviceId'").Id
foreach ($KeyId in $KeyIds) {
  (Get-MgInformationProtectionBitlockerRecoveryKey -BitlockerRecoveryKeyId $KeyId -Select "key").key
}

I haven’t run this block in a tenant. -Select is a documented alias of -Property, and the Device.Read.All scope for Get-MgDevice is my assumption, so test it with a non-production device first.

Don’t schedule a job that exports every key to a CSV. A file of recovery passwords unlocks every drive on it. Microsoft’s guidance is to control access to recovery passwords and store them separately from the devices they protect.

Active Directory (AD DS)

For domain-joined devices, use BitLocker Recovery Password Viewer. It ships with RSAT as an extension for Active Directory Users and Computers. You can open the computer object’s BitLocker recovery information, or search the domain using the first eight characters of the password ID shown on the recovery screen (Password ID (first 8 characters)).

Let users recover their own keys

If keys are in Entra ID, users can get keys for devices they own without calling you:

• At https://myaccount.microsoft.com, under Devices, they select the device and View BitLocker Keys.
• Through the Company Portal app. The Intune BitLocker article lists it as a self-service option.

Self-service is on by default. To turn it off, enable the Entra device setting Restrict users from recovering the BitLocker key(s) for their owned devices. Microsoft also describes using a Conditional Access Require compliant device policy so noncompliant devices can’t retrieve keys. Each user retrieval is logged under Key Management with the activity Read BitLocker key.

When a reused Autopilot device gets a new owner, that owner has to ask an admin for the key.

Rotate after every disclosure

Microsoft’s help desk checklist ends with rotating the recovery password, because anyone who saw it can unlock the drive.

• Automatic: set Client-driven recovery password rotation in your BitLocker policy. Entra joined and hybrid joined devices then rotate the password after it’s used to unlock the drive.
• On demand in Intune: Devices > All devices > device > BitLocker key rotation. If it isn’t visible, look under the ellipsis. Requirements:
  • Windows 10, version 1909 or later, or Windows 11.
  • Client-driven recovery password rotation enabled.
  • Save BitLocker recovery information to Microsoft Entra ID = Enabled.
  • Store recovery information in Microsoft Entra ID before enabling BitLocker = Required.
  • An Intune role with Remote tasks > Rotate BitLockerKeys (preview).
• On the device: Microsoft’s BitLocker operations guide shows removing the old recovery password protector, adding a new one, and backing it up with BackuptoAAD-BitLockerKeyProtector (Entra ID) or Backup-BitLockerKeyProtector (AD DS).

Avoid triggering recovery in the first place

• For planned firmware or hardware work, suspend BitLocker protection first. The drive stays encrypted, and protection resumes automatically at the next reboot unless you set a reboot count.
• Don’t delete the Intune object of a BitLocker-protected Entra joined device casually. Microsoft warns that the deletion triggers a sync that removes the OS volume’s key protectors and leaves BitLocker suspended.
• If you also see BitLocker using 128-bit encryption when you configured 256-bit, that’s a separate Autopilot issue: BitLocker defaults to 128-bit when 256-bit is configured.

FAQ

Where do I find a BitLocker recovery key in Intune?

Devices > All devices > select the device > Recovery keys > Show Recovery Key. You need a role with the microsoft.directory/bitlockerKeys/key/read permission, such as Helpdesk Administrator or Cloud Device Administrator.

What is the recovery key ID?

It’s the identifier shown on the BitLocker recovery screen. Use it to pick the right recovery password when a device has more than one stored in Entra ID or AD DS.

Can users get their own recovery key?

Yes, by default, for devices they own, through https://myaccount.microsoft.com or Company Portal. Admins can turn this off in Entra device settings.

Intune says “No BitLocker key found for this device”. What now?

The key isn’t in Entra ID. Work through Fix Intune BitLocker recovery key escrow failures.

Should I rotate the key after using it?

Yes. Microsoft’s help desk process includes rotating the recovery password after it’s disclosed. Use client-driven rotation, or the Intune BitLocker key rotation action.

Sources

• BitLocker recovery overview, Microsoft Learn (updated October 8, 2026)
• BitLocker recovery process, Microsoft Learn (updated October 8, 2026)
• Encrypt Windows devices with BitLocker in Intune, Microsoft Learn
• Manage device identities: view or copy BitLocker keys, Microsoft Learn
• Get-MgInformationProtectionBitlockerRecoveryKey, Microsoft Learn
• BitLocker operations guide, Microsoft Learn