Unable to save bitlocker key to Azure AD account

Question

we have a company we manage that recently got donated a bunch of laptops, I used an ISO from the VLSC that they have to install one of these laptops and used a key inside the VLSC to ensure it was a windows 11 pro/business licenced device, I joined the laptop to their Azure AD and the laptop shows in the Endpoint manager as compliant with intune, the problem I am facing though is I am unable to save the Bitlocker key to their Azure AD account as I keep getting the error "Can't save to your Azure AD account", after this I went digging into the event viewer and got greeted with this error message

"Failed to backup BitLocker Drive Encryption recovery information for volume C: to your Azure AD.

TraceId: {b99dc2fd-a017-45b9-975e-f766d33f7092}

Error: Unknown HResult Error code: 0x80072f8f"

Now after a few quick Google searches I feel I have tried everything recommended and still have 0 luck and am unable to backup the BitLocker key to their Azure AD, for the time being I have saved the key to a USB stick and the drive has successfully encrypted but I am stumped as to why it refuses to allow me to backup the key, we also just got a second and third machine installed with the windows ISO and the same issue occurs, The devices all have a Tpm 2.0 chip or equivalent and secure boot is enabled

Answer 1

Solution provided by @Constantin Lorenz worked for me:

Removing 3 lines from registrykey worked.

Problem occured unter Windows 11 Version 10.0.22621

Output from tpmtool:

tpmtool getdeviceinformation

-TPM vorhanden: Wahr
-TPM-Version: 2.0
-TPM-Hersteller-ID: IFX
-Vollstõndiger Name des TPM-Herstellers: Infineon
-TPM-Herstellerversion: 7.63.3353.0
-PPI-Version: 1.3
-Ist intialisiert: Wahr
-Zum Speichern bereit: Wahr
-F³r Nachweis bereit: Wahr
-Ist nachweisfõhig: Wahr
-Muss zum Wiederherstellen gel÷scht werden: Falsch
-L÷schen m÷glich: Wahr
 Falsch
-Bitlocker PCR7-Bindungsstatus: Gebunden
-Wartungsaufgabe abgeschlossen: Wahr
-TPM-Spezifikationsversion: 1.16
-TPM-Errata-Datum: Wednesday, September 21, 2016
-PC-Clientversion: 1.00
-Lockout-Informationen:
        -Ist gesperrt: Falsch
        -Lockout-Counter: 0
        -Max. Authentifizierungsfehler: 31
        -Lockout-Intervall: 600s
        -Lockout-Wiederherstellung: 86400s

Answer 2

Did anyone ever got a solution from Microsoft on that issue?

Besides deleting those 3 registry entries.

Answer 3

Hi

The same thing happened to me and it was because I had SSL inspection activated in the organization's firewall.