On-Prem joined domain PCs does not have option to save Bitlocker Recovery Key to Azure AD Account

Question

Hi,

Registered AD Joined PCs(On-Prem AD joined domain), I do not have way to save Bitlocker Recovery Key to Azure AD Account.
When I dis-join from the On-Prem AD, I have options to save them to Azure AD but as soon as joined back to the On-Prem AD domain, I do not have the option to save Azure AD account.

Is there any GPO that is blocking or enable that we can save bitlocker recovery key to Azure AD account?

Answer 1

Hi @DR_DR ,

I understand that you are having trouble saving a Bitlocker Recovery Key to an Azure AD account.

The recovery keys are uploaded when the device is hybrid Azure AD Joined and managed in Microsoft Endpoint Manager (Intune) via Autopilot.

If the devices were already Bitlockered, you need to use an Endpoint protection template to save the Bitlocker recovery information to Azure AD under Admin center > Devices > Configuration Profiles > Create Profile > Templates > Endpoint protection >Configuration settings > Windows Encryption > Save BitLocker recovery information to Azure Active Directory

See also:
Store BitLocker Recovery Keys in Azure AD for Devices Already Encrypted
Backup BitLocker Keys to Azure AD
Powershell script for Backing up Bitlocker key to Azure AD