Summary
The Recovery Key is stored in Azure AD when joining a device to Azure AD and by activating Bitlocker. To find the recovery key, the details are available for registered devices in the Azure AD Management Portal.
Problem
There are two different use cases where either an end-user or a system administrator needs to find the Bitlocker recovery key. In addition, Microsoft has multiple user interfaces, and administrative URL’s to navigate in order to find the recovery key. While it is helpful to be able to find the recovery key through different interfaces, this confuses the user and complicates training or documentation. This article documents how to find the Bitlocker Recovery Key and the various options.
Option 1, Using the Azure Management Portal
- Open the Azure AD resource object in the Management Portal
https://manage.windowsazure.com - Go to the All Users object and search for the account associated to the device.
- Click the user object name to view the profile properties
- Go to the Devices object under the Manage heading.
- Select the appropriate listed device.
- If the device is registered with Bitlocker encryption, then the Bitlocker Key ID and Recovery Key will be visible.
- Click the Copy to Clipboard button and paste the data to view the entire string.
Option 2, Using the Microsoft 365 (Intune) Device Management Admin Center or Office 365 Portal
- Open the Microsoft 365 admin center https://admin.microsoft.com or https://portal.office.com
- Go to the Device Management admin center
- The browser will open the Microsoft 365 Device Management interface at https://devicemanagement.microsoft.com
- Go the Devices object
- Go to the “All devices” object under the Manage section
- Search for the appropriate target device
- In the “Monitor” section, find and click on “Recovery keys”
- Click the Copy to Clipboard button and paste the data to view the entire string.
Option 3, Using the Company Portal website
- Sign into the Intune Company Portal website from any device.
- In the portal, go to Devices and select the macOS device that is encrypted with FileVault.
- Select Get recovery key. The current recovery key is displayed.
- On an iPhone, you must select the three dots before the Get recovery key option appears.
References
Leave a Reply
Want to join the discussion?Feel free to contribute!
Very helpful! Can you expand on this: what if the key is not there, even though a device compliance policy exists that requires BitLocker?
Is there an option to get the BitLocker keys by PowerShell?
I need BitLocker recovery key.
Organization I worked is split into two (spin off happened from 01/011). My laptop in first company had my identifier in Azure AD with device registered. But my ID got deleted, device set to “Inactive” mode. I can’t login to system. System ID: DESKTOP-VMNMSIK, Device object id: 090857b2-046a-4e96-b62d-fa2aea3cf588. Contacted my first organization and their answer “Your identities are deleted, we can’t help”. Need Microsoft help to get BitLocker recovery key for getting my data.
Please help.
You’re forgetting the easiest place for a user to find the recovery keys:
https://myaccount.microsoft.com/device-list
Is there someone I can talk to? About the Bitlocker Recovery Key?