Can Hexnode escrow BitLocker recovery keys to Microsoft Entra ID without AD DS?Solved

Hello @jayceon ,

Yes, BitLocker recovery keys can be stored in Microsoft Entra ID alongside the Hexnode UEM portal.

When BitLocker is configured through Hexnode, the recovery key is saved in the portal under Manage > Endpoints > [Select the device] > Device Summary > Device Basics > Drive > BitLocker Recovery Password.

For Windows devices that are Microsoft Entra joined or Entra hybrid joined, the OS drive recovery key can also be backed up directly to Microsoft Entra ID. An on-premises AD DS setup is not required.

To enforce this in your BitLocker policy, navigate to OS Drive Settings, check Configure recovery options, and enable the option Do not enable BitLocker until recovery information is stored in AD DS.

Regards,
Simon Scott
Hexnode UEM

If we do not have AD DS at all, will it still save to Entra ID, or does it expect AD DS first and fail?

The setting does not require an on-premises AD DS environment. In this context, Windows will automatically use the appropriate directory based on how the device is joined.

For Microsoft Entra joined or Entra hybrid joined Windows devices, the recovery information is backed up to Microsoft Entra ID. For devices joined to an on-premises Active Directory, AD DS is used.

Therefore, if your device is Entra joined, enabling this option ensures that BitLocker encryption will not proceed until the recovery key is safely escrowed to your Entra ID.