bitlocker recovery key id not found in entra id
This skill handles the helpdesk emergency where the BitLocker recovery key ID shown on the locked machine has no matching key in Entra ID. It walks through confirming the right device record, checking backup timing, and falling back to other escrow locations. Not for machines that never had BitLocker enabled.
TL;DR
First make sure you are looking at the right device record: match the first eight characters of the key ID on the recovery screen against the keys stored under the device in Entra ID. If no key matches, the device likely reinstalled without re-escrowing, so check your MBAM store, configuration manager, or a printed backup before declaring the data unrecoverable.
Steps
On the recovery screen, note the key ID shown and the device name. Expected: You have the key ID to match.
In Entra ID, open the device record and list its recovery keys, comparing key IDs. Expected: You find a match, or you confirm none match.
If none match, check alternate escrow: your MBAM database, configuration manager, or the user's printed or saved backup. Expected: A key is found, or all stores are confirmed empty.
If a key is found, enter it at the recovery screen; if not, follow your data-loss process and re-image. Expected: The drive unlocks, or the loss is documented and the device rebuilt.
When to use
- The BitLocker recovery screen shows a key ID with no match in Entra ID
- The machine was recently reimaged or had its TPM cleared
- You need the documented fallback order before telling the user the data is gone
When not to use
- The key ID matches and the key is present (just enter it)
- BitLocker was never enabled (no key exists anywhere)
- The drive is a personal device outside management
Why this happens
BitLocker escrows a new recovery key each time the drive is encrypted, and reimaging or TPM clears can generate a key that never escrows if the escrow policy was not enforced at that moment. The old key in Entra ID then belongs to a previous encryption, with a different key ID.
Edge cases
- Hybrid-joined devices may escrow to AD instead of Entra ID; check both.
- A key ID match with a wrong key means the escrow is corrupt; try alternate stores before giving up.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_t8PqE6OCgKQjWAEMw-5XKw