How to force escrowing of BitLocker recovery keys using Intune

Every now and then it so happens that BitLocker recovery keys do not escrow in AAD. The usual culprits are incorrect BitLocker policies and\or the device hardware configuration failing to meet the minimum requirements. The other scenario and something I recently experienced is when everything is setup right and still the recovery key doesn’t escrow in AAD.

As I understand, this can happen if the escrow process got interrupted the first time due to network or local devices related issues and the process could not resume. To circumvent this issue, one can simply push a PowerShell script to the devices to force the escrow of the recovery keys to AAD. Here is a script to do so.

try{
$BitlockerVol = Get-BitLockerVolume -MountPoint $env:SystemDrive
        $KPID=""
        foreach($KP in $BitlockerVol.KeyProtector){
            if($KP.KeyProtectorType -eq "RecoveryPassword"){
                $KPID=$KP.KeyProtectorId
                break;
            }
        }
       $output = BackupToAAD-BitLockerKeyProtector -MountPoint "$($env:SystemDrive)" -KeyProtectorId $KPID
return $true
}
catch{
     return $false
}

To set this up in Intune, follow the steps below.

1. Sign-in to the Microsoft Endpoint Manager admin center portal. 

2. Browse to Devices – Windows – PowerShell Scripts

3. Click on Add

4. Give a Name

5. Select the script

6. Set Run this script using the logged on credentials as No

7. Set Enforce script signature check to No

8. Set Run script in 64 bit PowerShell Host as Yes

9. Deploy to the user\device based group.

Once the script executes, the devices should escrow the recovery key to AAD almost immediately. You can check under Devices->Windows->Recovery Keys

Or AAD->Devices

Or head over to Graph Explorer – Microsoft Graph and pull the details on the recovery keys and devices ids using https://graph.microsoft.com/beta/bitlocker/recoveryKeys.

References

BitLocker Management Recommendations for Enterprises (Windows 10) - Microsoft 365 Security | Microsoft Docs

Get bitlockerRecoveryKey - Microsoft Graph beta | Microsoft Docs