There are prerequisites that devices must meet to support rotation. Only the key used for recovery is refreshed.Īn administrator can initiate BitLocker key rotation remotely from the Microsoft Endpoint Manager admin center by navigating to Devices > Windows to select the device for the BitLocker key rotation. This option provides a method to back up recovery information to Microsoft Azure Active Directory (Azure AD) or Azure Active Directory Domain Services (Azure AD DS).Īdditionally, new password rotation functionality added in Windows 10, version 1909, allows the recovery key to refresh automatically after it is used to recover a BitLocker enabled device. Since the inception of the BitLocker configuration service provider (CSP) in Windows 10, version 1703, there’s been an option to configure BitLocker recovery on protected operating system (OS) drives. This post walks you through BitLocker recovery options with Windows devices managed with Intune. You can read about the reasons a device enter s recovery mode in the documentation under What causes BitLocker recovery. In the first post, we described occasions when a BitLocker-enabled device enters recovery mode.

This is the fourth blog in our series on using BitLocker with Intune. By Luke Ramsdale – Service Engineer | Microsoft Endpoint Manager – Intune

Bitlocker key recovery tool