Bitlocker recovery keys hybrid-joined devices

Bjorn Claes 21

We have a Bitlocker policy configured as shown in the image, but it's giving mixed results and I can't figure out why. For some devices the Recovery Key is stored in Azure AD + AD, while for other devices the Recovery Key is only stored in AD. The option: Require device to back up recovery information to Azure AD is enabled, all of the devices are encrypted and still 2/3 of the devices don't have a Recovery Key stored in AAD.
All devices are hybrid-joined, they all have the same autopilot profile, are in the same groups ...

3 answers

Limitless Technology 39,421 Reputation points

2021-12-03T19:34:33.377+00:00

Hello @Bjorn Claes

I would recommend with manual backup and setting for the Recovery Key backup to AAD.

Please check the instructions and blog in https://learn.microsoft.com/en-us/answers/questions/579227/backup-bitlocker-keys-to-azure-ad.html

Hope this helps with your query,

-------
--If the reply is helpful, please Upvote and Accept as answer--
Please sign in to rate this answer.
Bjorn Claes 21 Reputation points

2021-12-03T20:31:21.107+00:00

I’ve created a script as workaround, but I don’t see it as a permanent solution. Running the script is a one-time-shot, so for example what will happen when a key rotation is triggered? Also the policy states that Bitlocker is enabled only if the key is saved in Azure AD and that’s not the case: the drive is encrypted, but the key isn’t saved in Azure AD.
Sign in to comment
Nick Hogarth 3,436 Reputation points

2021-12-03T20:07:49.187+00:00

If you are using the same policy across devices but getting different results, you're probably best of logging an Intune support case.
Please sign in to rate this answer.
Bjorn Claes 21 Reputation points

2021-12-03T20:35:13.69+00:00

I’ve opened a support case, so I will provide an update here once we find a solution.
Sign in to comment
Jason Sandys 31,176 Reputation points Microsoft Employee

2021-12-06T17:35:37.403+00:00

The most likely cause here is that the device simply hasn't completed its HAADJ process when the recovery password is initially set (which is the only time that Windows will save the recovery password). The HAADJ process depends on a user logging into the device which is not in any way guarenteed.

Have you reviewed the BitLocker event log?
Please sign in to rate this answer.
Bjorn Claes 21 Reputation points

2021-12-08T11:34:58.863+00:00

We have 3 devices, enrolled at the same time with the same user: 1 device has the recovery key in Azure AD, 2 others don't. In the Bitlocker event log of those 2 devices there is an event where the recovery key is saved in AD, but not Azure AD.

As we enabled: "Require device to back up recovery information to Azure AD", in my opinion those 2 devices shouldn't be encrypted because the key isn't saved in Azure AD.

Jason Sandys 31,176 Reputation points Microsoft Employee

2021-12-08T15:27:37.503+00:00

The settings description is a bit misleading and depends on the device's join type. Windows itself makes not true to distinction between AD and AAD for the purpose of saving the recovery password on a hybrid Azure Active Directory joined device. For this type of joined device it attempts to save to both places at the time the key is set and if either succeeds, it is considered a success.

Just another, albeit smaller in this case, reason not to use Autopilot + hybrid Azure Active Directory join on newly provisioned endpoints.

Tim Vermeiren 1 Reputation point

2022-03-22T15:40:43.657+00:00

We are using the preprovisioning variant of Autopilot with Hybrid AADJ, so user sign-in is usually much later. Does this mean that bitlocker will fail in most cases as the preprovisioning is usually finished faster then Hybrid AADJ? We do see a low successrate in bitlocker encryption (with similar settings same as above)

Jason Sandys 31,176 Reputation points Microsoft Employee

2022-03-22T17:10:47.98+00:00

Are you saying BitLocker encryption itself is failing or just the saving of the recovery key?

James Field 1 Reputation point

2022-03-24T10:57:32.623+00:00

Thanks, this was my issue too
What would be the best way to ensure the keys, which may be rotated in the future, are backed up to both AD and AAD, please?

regards

Jason Sandys 31,176 Reputation points Microsoft Employee

2022-03-24T13:59:45.247+00:00

Use a script delivered from Intune or ConfigMgr. Better yet, start using AADJ which we strongly prefer for new device provisioning.
Sign in to comment

Share via

Bitlocker recovery keys hybrid-joined devices

3 answers