PowerShell: Enable BitLocker and Backup Recovery Key to Microsoft Entra ID

<#
.SYNOPSIS
    Enable BitLocker and back up the recovery key to Microsoft Entra ID.
.DESCRIPTION
    Checks for TPM, enables BitLocker with XTS-AES-256 encryption,
    adds a recovery password protector, and backs up to Microsoft Entra ID.
    Safe to run on devices that are already encrypted — it will
    only back up the existing key.
.PARAMETER MountPoint
    The drive to encrypt. Defaults to C:
#>

param(
    [string]$MountPoint = "C:"
)

# Require admin
if (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Write-Error "This script must be run as Administrator."
    exit 1
}

# Check for TPM
$tpm = Get-Tpm -ErrorAction SilentlyContinue
if (-not $tpm.TpmPresent) {
    Write-Error "No TPM detected. BitLocker requires a TPM 2.0 chip."
    exit 1
}

if (-not $tpm.TpmReady) {
    Write-Warning "TPM is present but not ready. Attempting to initialize..."
    Initialize-Tpm -ErrorAction Stop
}

# Check current BitLocker status
$volume = Get-BitLockerVolume -MountPoint $MountPoint -ErrorAction Stop

if ($volume.VolumeStatus -eq "FullyEncrypted") {
    Write-Host "Drive $MountPoint is already encrypted." -ForegroundColor Green

    # Ensure a recovery password protector exists
    $recoveryProtector = $volume.KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' }

    if (-not $recoveryProtector) {
        Write-Host "Adding recovery password protector..."
        $result = Add-BitLockerKeyProtector -MountPoint $MountPoint -RecoveryPasswordProtector
        $recoveryProtector = $result.KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' }
    }
} elseif ($volume.VolumeStatus -eq "EncryptionInProgress") {
    Write-Host "Encryption is already in progress. Waiting..."
    $recoveryProtector = $volume.KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' }
} else {
    Write-Host "Enabling BitLocker on $MountPoint..."

    # Enable BitLocker with TPM protector
    Enable-BitLocker -MountPoint $MountPoint `
        -EncryptionMethod XtsAes256 `
        -TpmProtector `
        -SkipHardwareTest `
        -ErrorAction Stop

    # Add recovery password protector
    $result = Add-BitLockerKeyProtector -MountPoint $MountPoint -RecoveryPasswordProtector
    $recoveryProtector = $result.KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' }

    Write-Host "BitLocker enabled. Encryption is now in progress." -ForegroundColor Green
}

# Back up recovery key to Microsoft Entra ID (cmdlet retains AAD name for backward compatibility)
if ($recoveryProtector) {
    try {
        BackupToAAD-BitLockerKeyProtector -MountPoint $MountPoint -KeyProtectorId $recoveryProtector.KeyProtectorId -ErrorAction Stop
        Write-Host "Recovery key backed up to Microsoft Entra ID successfully." -ForegroundColor Green
        Write-Host "Key ID: $($recoveryProtector.KeyProtectorId)" -ForegroundColor Cyan
    } catch {
        Write-Warning "Failed to back up to Microsoft Entra ID: $_"
        Write-Warning "Recovery password (SAVE THIS): $($recoveryProtector.RecoveryPassword)"
    }
} else {
    Write-Error "No recovery password protector found. Cannot back up."
    exit 1
}

# Display final status
$finalVolume = Get-BitLockerVolume -MountPoint $MountPoint
Write-Host "`n--- BitLocker Status ---" -ForegroundColor Cyan
Write-Host "Volume:     $MountPoint"
Write-Host "Status:     $($finalVolume.VolumeStatus)"
Write-Host "Encryption: $($finalVolume.EncryptionMethod)"
Write-Host "Protectors: $($finalVolume.KeyProtector.Count)"
Write-Host "Key ID:     $($recoveryProtector.KeyProtectorId)"

.\Enable-BitLockerAzureAD.ps1

powershell.exe -ExecutionPolicy Bypass -File .\Enable-BitLockerAzureAD.ps1

# Requires Microsoft Graph module
Connect-MgGraph -Scopes "BitLockerKey.Read.All"
Get-MgInformationProtectionBitlockerRecoveryKey -Filter "deviceId eq 'DEVICE-ID'"