Backing Up BitLocker Recovery Keys to Microsoft Entra ID

I recently found myself trying to recover a Windows computer that had become locked behind BitLocker. Unfortunately, nobody had the recovery key. I checked everywhere I reasonably could, but it was nowhere to be found.

Ultimately, we had no choice but to wipe the computer and reinstall Windows. Everything stored locally on the encrypted drive was effectively inaccessible.

Lovely.

To be fair, BitLocker was doing exactly what it was designed to do. It was preventing unauthorized access to the encrypted drive. Unfortunately, that also included us.

What frustrated me was how preventable the situation was. Microsoft provides a perfectly good mechanism for securely backing up BitLocker recovery keys to Microsoft Entra ID, allowing administrators to retrieve them when needed. The problem is that just because a computer has BitLocker enabled does not necessarily mean that its recovery key has been backed up somewhere useful.

So, in the interest of never having to deal with this particular headache again, here is how to associate an existing Windows 11 computer with Microsoft Entra ID, back up its BitLocker recovery key, and verify that the backup actually exists.

These instructions assume Windows 11 Pro and an existing local Windows account.

Join the Computer to Microsoft Entra ID

Before we can back up the recovery key to Entra, the computer needs to be associated with the organization's Microsoft Entra tenant.

If the computer was originally configured using a local Windows account, that's fine. There is no need to reinstall Windows or abandon the existing account.

While signed in using an account with local administrator privileges:

  1. Open Settings → Accounts → Access work or school.
  2. Click Connect.
  3. In the window that appears, look for Join this device to Microsoft Entra ID under the alternate actions.
  4. Sign in using an authorized organizational Microsoft 365 account.
  5. Confirm that the correct organization is displayed.
  6. Click Join and complete the process.

Pay particular attention to step 3.

Simply entering a Microsoft 365 email address into the initial connection window is not the same as joining the computer to Entra. Windows supports both operations, and the distinction matters.

Once completed, the computer will be associated with the organization's Microsoft Entra tenant.

The existing local account will continue to work. Windows does not automatically convert that account into an Entra account, nor does it migrate the user's profile.

Also, depending on the organization's configuration, joining Entra may automatically enroll the computer in Microsoft Intune. This is not required for the manual recovery-key backup described here, but it is worth being aware of.

Confirm That BitLocker Is Enabled

Before proceeding, we should confirm that BitLocker is actually protecting the drive.

Open Command Prompt as Administrator and run:

manage-bde -status C:

Look for:

Protection Status: Protection On

The output also provides information about the encryption method, percentage encrypted, and key protectors.

If BitLocker is disabled, it can be enabled through:

Control Panel → System and Security → BitLocker Drive Encryption

Select Turn on BitLocker for the operating system drive and follow the instructions.

If BitLocker is already enabled, there is no reason to disable it or decrypt the drive just to back up the recovery key.

Back Up the Recovery Key to Microsoft Entra

There are two ways to approach this.

Option 1: Using Control Panel

For computers that expose the appropriate backup option, Windows provides a fairly straightforward interface.

  1. Open Control Panel → System and Security → BitLocker Drive Encryption.
  2. Locate the operating system drive, usually C:.
  3. Click Back up your recovery key.
  4. Select Save to your Azure AD account, or Save to Entra ID account if available.
  5. Complete the backup.

Yes, Windows may still refer to Azure Active Directory despite the product now being called Microsoft Entra ID.

The option may not appear on every computer, particularly when working from a local Windows account.

Also, be careful not to confuse Save to your Microsoft account with Save to your Azure AD account or Save to Entra ID account. The former refers to a personal Microsoft account, while the latter is associated with the organization's Entra tenant.

If Windows doesn't offer the correct option, don't spend too much time trying to convince it otherwise. The command-line method is straightforward.

Option 2: Using Command Prompt

This is the method I prefer, particularly when working with an existing computer configured using a local account.

Open Command Prompt as Administrator and run:

manage-bde -protectors -get C:

This displays the BitLocker key protectors associated with the drive.

Look for a section similar to:

Numerical Password:
    ID: {12345678-1234-1234-1234-123456789ABC}
    Password:
        [48-digit recovery password]

The important value here is the ID under Numerical Password.

This is the BitLocker Recovery Key ID, not the computer's Entra Device ID and not the TPM protector ID.

We can use it to identify the recovery password and tell Windows exactly which key to back up.

Execute:

manage-bde -protectors -aadbackup C: -id {ID}

Replace {ID} with the actual identifier returned by the previous command, including the curly braces.

For example:

manage-bde -protectors -aadbackup C: -id {12345678-1234-1234-1234-123456789ABC}

If successful, Windows should report that the recovery information has been backed up.

One small but important detail: -aadbackup backs up the recovery information to Microsoft Entra ID. There is also an -adbackup option, which targets traditional on-premises Active Directory. These are not interchangeable.

If the original command doesn't display a Numerical Password protector, one can be created using:

manage-bde -protectors -add C: -RecoveryPassword

Then retrieve its ID and run the backup command.

Verify That the Recovery Key Actually Exists in Entra

This is the part I care about most.

Windows telling me that something worked is nice. Actually seeing the result where I expect it to be is considerably nicer.

Fortunately, Microsoft Entra provides a way to search directly for a BitLocker recovery key without needing to know the computer's name or locate its device record first.

  1. Open the Microsoft Entra Admin Center.
  2. Navigate to Entra ID → Devices → BitLocker keys.
  3. Enter the BitLocker Recovery Key ID obtained earlier from manage-bde -protectors -get C: into the key search field.
  4. Locate the corresponding record.
  5. Confirm that the recovery key is associated with the expected computer.

The identifier can be entered without the surrounding curly braces if necessary.

This is particularly convenient because the same recovery key identifier is also presented when Windows enters BitLocker recovery mode.

If the computer ever becomes locked, we can use that identifier to locate the correct recovery password.

An administrator with the appropriate permissions can select Show Recovery Key to retrieve the actual 48-digit recovery password.

For verification purposes, I generally don't need to reveal the password itself. Finding the matching recovery key record associated with the correct device is enough to confirm that the backup exists.

If the key doesn't appear, something is wrong. Check that the computer is joined to the correct tenant and repeat the backup operation.

Do not simply assume that because the computer is listed under Entra Devices, its recovery key must also be there.

A Few Things Worth Remembering

Local Windows accounts are perfectly fine. A computer can be joined to Microsoft Entra while continuing to use its existing local Windows account. There is no need to create an entirely new Windows profile simply to back up the BitLocker key.

Microsoft Intune is not required. Although Intune can manage BitLocker configuration and recovery-key policies, manually backing up a key to Entra does not require the computer to be enrolled in Intune.

Recovery keys don't automatically migrate between tenants. If a computer is moved from one Microsoft Entra tenant to another, its existing recovery-key backup doesn't magically follow it. Make sure the current key is securely preserved and backed up to the destination tenant as part of the migration.

The recovery password is sensitive. Anyone with the correct recovery password and physical access to the encrypted drive may be able to unlock it. Avoid copying the 48-digit password into tickets, screenshots, or unsecured documentation.

And finally, encryption is not a backup. BitLocker protects the confidentiality of information stored on the drive. It does absolutely nothing to ensure that the information can be recovered if the key is lost.

One Less Thing to Worry About

After dealing with a computer that had to be completely wiped because its recovery key couldn't be located, I have considerably less patience for assuming these things are configured correctly.

The entire process of joining a computer to Entra, backing up the recovery key, and verifying its existence takes very little effort compared to rebuilding a computer from scratch.

It is also considerably less frustrating.

For something as important as disk encryption, I would really prefer that recovery-key management be a little harder to overlook. Ideally, organizations should be enforcing this automatically through their device management policies rather than relying on administrators to remember to do it manually.

Until then, at least we have a straightforward way to take care of it ourselves.

And hopefully, the next time Windows decides that a perfectly functional computer needs its BitLocker recovery key, I'll be able to retrieve it rather than reaching for a Windows installation USB.