BitLocker & device encryption

Back Up BitLocker Key to Entra ID

Backs up the BitLocker recovery key for a drive to Entra ID.

Download .ps130 lines · PowerShell

Replace generic placeholder values (tenant, domain, secrets) for your own environment before running. Read it first and test safely.

$ErrorActionPreference = "Stop"
$drive = "C:"

try {
  # Make sure the cmdlet exists (Windows/PowerShell build dependent)
  if (-not (Get-Command BackupToAAD-BitLockerKeyProtector -ErrorAction SilentlyContinue)) {
    throw "BackupToAAD-BitLockerKeyProtector cmdlet not available on this device."
  }

  $vol = Get-BitLockerVolume -MountPoint $drive

  # Find a Recovery Password protector
  $kp = $vol.KeyProtector |
    Where-Object { $_.KeyProtectorType -eq "RecoveryPassword" } |
    Select-Object -First 1

  if (-not $kp) {
    throw "No RecoveryPassword protector found on $drive."
  }

  # Push to Entra (AAD)
  BackupToAAD-BitLockerKeyProtector -MountPoint $drive -KeyProtectorId $kp.KeyProtectorId | Out-Null

  Write-Output "OK: Backed up BitLocker recovery key to Entra. KeyProtectorId=$($kp.KeyProtectorId)"
  exit 0
}
catch {
  Write-Error "FAILED: $($_.Exception.Message)"
  exit 1
}