Question

Your organization has silently encrypted all corporate Windows 11 laptops with BitLocker using an Intune disk encryption policy, and recovery keys are escrowed to Microsoft Entra ID. A user working remotely is prompted for a BitLocker recovery key after a firmware change and cannot reach the helpdesk. You want to enable users to retrieve their own recovery keys without administrator involvement, while keeping helpdesk staff able to assist when needed. What should you do?

Accepted Answer

Direct the user to sign in to the My Account (myaccount.microsoft.com) / Devices page and view the BitLocker recovery key for their device

Answer

Configure the Intune disk encryption policy to disable escrow of recovery keys so keys are stored only on the device

Answer

Use the Intune remote action 'Rotate BitLocker keys' and email the new key to the user

Answer

Have the user run manage-bde -protectors -get C: from an elevated command prompt to display the recovery key