BitLocker Recovery Key Not Found in Microsoft Entra ID — How to Fix

Overview

You are staring at a BitLocker recovery screen asking for a 48-digit recovery key. You check Microsoft Entra ID — nothing. This is one of the most stressful situations in IT support, because without that key, the data on the drive is permanently inaccessible.

This guide covers where else to look, how to force a backup if the drive is still accessible, and how to prevent this from happening again.

Step 1: Confirm the Key ID

The BitLocker recovery screen shows a Key ID (the first 8 characters of the recovery key identifier). Write this down — you need it to search for the correct key.

Example: Key ID: 6A8B2F4C

Step 2: Search All Possible Locations

Microsoft Entra ID

1. Go to the Microsoft Entra admin center (entra.microsoft.com) > Devices > search for the device name
2. Click the device > BitLocker keys
3. Match the Key ID to the recovery key

If the device does not appear or has no keys:

# Search via Microsoft Graph PowerShell
Connect-MgGraph -Scopes "BitLockerKey.Read.All"
Get-MgInformationProtectionBitlockerRecoveryKey -Filter "deviceId eq 'DEVICE-OBJECT-ID'" | Select-Object Id, CreatedDateTime, DeviceId

On-premises Active Directory

If the device was ever domain-joined:

# Search by computer name
$computer = Get-ADComputer -Identity "COMPUTER-NAME"
Get-ADObject -Filter {objectClass -eq 'msFVE-RecoveryInformation'} -SearchBase $computer.DistinguishedName -Properties msFVE-RecoveryPassword | Select-Object Name, msFVE-RecoveryPassword

Microsoft account (personal devices)

If the PC was set up with a personal Microsoft account, the key may be at:

https://account.microsoft.com/devices/recoverykey

The user must sign in with the Microsoft account that was active when BitLocker was enabled.

Printed or saved to a file

When BitLocker was first enabled, the user may have been prompted to save the key. Check:

• USB drives
• Printed documents
• Text files on other drives or cloud storage
• IT team documentation or ticketing systems

Intune

If the device is managed by Intune:

1. Go to Microsoft Intune admin center (intune.microsoft.com) > Devices > All devices
2. Search for the device > Recovery keys

Step 3: The Drive Is Still Accessible — Force a Backup Now

If the device is currently running (not at the recovery screen), back up the key immediately before it is needed:

Backup to Microsoft Entra ID

# Find the recovery key protector ID
$volume = Get-BitLockerVolume -MountPoint "C:"
$recoveryProtector = $volume.KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' }

# Display the recovery key (save this!)
$recoveryProtector.RecoveryPassword

# Backup to Microsoft Entra ID
BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $recoveryProtector.KeyProtectorId

Backup to on-premises AD

Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $recoveryProtector.KeyProtectorId

Save to a file (last resort)

manage-bde -protectors -get C: > "\\server\share\BitLockerKeys\$env:COMPUTERNAME.txt"

Step 4: No Key Found — Data Recovery Options

If no recovery key exists anywhere:

Option A: Suspend BitLocker (if Windows is running)

If the PC boots into Windows but is asking for the recovery key at pre-boot, try suspending BitLocker:

# If you can boot into Windows (e.g., via Safe Mode)
Suspend-BitLocker -MountPoint "C:" -RebootCount 1

This is possible when the recovery prompt is caused by a BIOS update or TPM firmware change, not a lost key.

Option B: Check for a clear key

In some rare configurations, the drive may have a "clear key" protector (used during encryption setup):

manage-bde -protectors -get C:

Look for a protector of type "External Key" — if found, the key file (.BEK) may be on a USB drive.

Option C: Accept data loss

If no key can be found and the drive cannot be unlocked, the data is unrecoverable. The drive must be reformatted:

1. Boot from a Windows installation USB
2. Open a command prompt (Shift + F10)
3. Run diskpart > select disk 0 > clean > create partition primary > format fs=ntfs quick
4. Reinstall Windows

Why Keys Go Missing

Prevention

Intune policy settings

In your Intune BitLocker policy, ensure:

Group Policy settings

Set "Do not enable BitLocker until recovery information is stored in AD DS" to Enabled under:

Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives

Monitoring

Run a monthly report to find devices with BitLocker enabled but no key in Microsoft Entra ID:

# Compare encrypted devices vs. devices with stored keys
$encryptedDevices = Get-MgDeviceManagementManagedDevice -Filter "isEncrypted eq true" | Select-Object DeviceName, Id
foreach ($device in $encryptedDevices) {
    $keys = Get-MgInformationProtectionBitlockerRecoveryKey -Filter "deviceId eq '$($device.Id)'" -ErrorAction SilentlyContinue
    if (-not $keys) {
        Write-Warning "NO KEY: $($device.DeviceName)"
    }
}