Microsoft Intune - BitLocker: Client-driven recovery password rotation error 0x87d1fde8 Remediation failed

Question

Hello!

I'm trying to silently encrypt devices via Intune Device Configuration profile.
The endpoints are on-prem domain-joined + azureAD-registered Windows 10 machines (10.0.19042)
The error I'm getting is Client-driven recovery password rotation Fails with -2016281112 (Remediation failed) error code 0x87d1fde8

Event log on the endpoint shows that configure recovery password rotation URI request is not supported:

The Device configuration profile settings are:

Could you please help figure out how this can be fixed?

Answer 1

I have noticed that this error is appearing when you haven't configured your TPM in the BIOS first.

Most of the laptops by default are with disabled TPM.

You should enable TPM and all storage keys there first and then roll your policy or Bitlocker rule again.

Answer 2

Was anyone else able to resolve this issue?

Answer 3

@TG - Would you be able to share your PS scripts please? This is causing a huge issue in our tenant and I would be eternally grateful! Thank you for your help.

Answer 4

It looks like Intune policy doesn't automatically turn on BitLocker for Azure AD Registered devices, because they are technically joined then as personal devices.

For automatic BitLocker encryption via built-in Intune policy, the device should be Azure AD Joined and logged in to Windows with a Work or school account.

I created PowerShell scripts that can take care of automated BitLocker encryption and escrow in the case of AAD Registered devices.

Answer 5

I am also experiencing this same issue and Bitlocker key is not getting escrowed to AAD. Note: I am using MS Endpoint Manger (Intune)- Endpoint Security -Disk Encryption Policy Template and targeting Autopilot HAADJ Windows 10 laptops.