BitLocker Key Not Found in Entra ID

Overviewsection

You are staring at a BitLocker recovery screen asking for a 48-digit recovery key. You check Microsoft Entra ID — nothing. This is one of the most stressful situations in IT support, because without that key, the data on the drive is permanently inaccessible.

This guide covers where else to look, how to force a backup if the drive is still accessible, and how to prevent this from happening again.

Step 1: Confirm the Key IDsection

The BitLocker recovery screen shows a Key ID (the first 8 characters of the recovery key identifier). Write this down — you need it to search for the correct key.

Example: Key ID: 6A8B2F4C

Step 2: Search All Possible Locationssection

Microsoft Entra IDsection

1. Go to the Microsoft Entra admin center (entra.microsoft.com) > Devices > search for the device name
2. Click the device > BitLocker keys
3. Match the Key ID to the recovery key

If the device does not appear or has no keys:

# Search via Microsoft Graph PowerShell
Connect-MgGraph -Scopes "BitLockerKey.Read.All"
Get-MgInformationProtectionBitlockerRecoveryKey -Filter "deviceId eq 'DEVICE-OBJECT-ID'" | Select-Object Id, CreatedDateTime, DeviceId

On-premises Active Directorysection

If the device was ever domain-joined:

# Search by computer name
$computer = Get-ADComputer -Identity "COMPUTER-NAME"
Get-ADObject -Filter {objectClass -eq 'msFVE-RecoveryInformation'} -SearchBase $computer.DistinguishedName -Properties msFVE-RecoveryPassword | Select-Object Name, msFVE-RecoveryPassword

Microsoft account (personal devices)section

If the PC was set up with a personal Microsoft account, the key may be at:

Microsoft Account Recovery Key Portal

The user must sign in with the Microsoft account that was active when BitLocker was enabled.

Printed or saved to a filesection

When BitLocker was first enabled, the user may have been prompted to save the key. Check:

• USB drives
• Printed documents
• Text files on other drives or cloud storage
• IT team documentation or ticketing systems

Intunesection

If the device is managed by Intune:

1. Go to Microsoft Intune admin center (intune.microsoft.com) > Devices > All devices
2. Search for the device > Recovery keys

Step 3: The Drive Is Still Accessible — Force a Backup Nowsection

If the device is currently running (not at the recovery screen), back up the key immediately before it is needed:

Backup to Microsoft Entra IDsection

# Find the recovery key protector ID
$volume = Get-BitLockerVolume -MountPoint "C:"
$recoveryProtector = $volume.KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' }

# Display the recovery key (save this!)
$recoveryProtector.RecoveryPassword

# Backup to Microsoft Entra ID
BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $recoveryProtector.KeyProtectorId

Backup to on-premises ADsection

Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $recoveryProtector.KeyProtectorId

Save to a file (last resort)section

manage-bde -protectors -get C: > "\\server\share\BitLockerKeys\$env:COMPUTERNAME.txt"

Step 4: No Key Found — Data Recovery Optionssection

If no recovery key exists anywhere:

Option A: Suspend BitLocker (if Windows is running)section

If the PC boots into Windows but is asking for the recovery key at pre-boot, try suspending BitLocker:

# If you can boot into Windows (e.g., via Safe Mode)
Suspend-BitLocker -MountPoint "C:" -RebootCount 1

This is possible when the recovery prompt is caused by a BIOS update or TPM firmware change, not a lost key.

Option B: Check for a clear keysection

In some rare configurations, the drive may have a "clear key" protector (used during encryption setup):

manage-bde -protectors -get C:

Look for a protector of type "External Key" — if found, the key file (.BEK) may be on a USB drive.

Option C: Accept data losssection

If no key can be found and the drive cannot be unlocked, the data is unrecoverable. The drive must be reformatted:

1. Boot from a Windows installation USB
2. Open a command prompt (Shift + F10)
3. Run diskpart > select disk 0 > clean > create partition primary > format fs=ntfs quick
4. Reinstall Windows

Why Keys Go Missingsection

Preventionsection

Intune policy settingssection

In your Intune BitLocker policy, ensure:

Group Policy settingssection

Set "Do not enable BitLocker until recovery information is stored in AD DS" to Enabled under:

Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives

Monitoringsection

Run a monthly report to find devices with BitLocker enabled but no key in Microsoft Entra ID:

# Compare encrypted devices vs. devices with stored keys
$encryptedDevices = Get-MgDeviceManagementManagedDevice -Filter "isEncrypted eq true" | Select-Object DeviceName, Id
foreach ($device in $encryptedDevices) {
    $keys = Get-MgInformationProtectionBitlockerRecoveryKey -Filter "deviceId eq '$($device.Id)'" -ErrorAction SilentlyContinue
    if (-not $keys) {
        Write-Warning "NO KEY: $($device.DeviceName)"
    }
}

Need help finding a recovery key?section

If you need help checking recovery-key locations and your device configuration, see our on-demand remote IT support. For ongoing device administration and backup planning, explore managed IT support. A support session cannot recreate a recovery key that was never saved.