Skip to content
MitoMito Docs

MP.RKS.IA.1001: Windows devices are BitLocker-encrypted and their recovery key is in Entra ID
ID MP.RKS.IA.1001
Severity High
Suite RKSolutions Intune Anomalies
Product Intune
Feature Endpoint security
Security area Devices and endpoints
Resource type Device
User impact of fixing Low
Effort to fix Medium
Provides evidence for ISO 27001:2022: A.8.24 (partial), A.8.1 (partial)
UAE IA v1.1: T7.4.2 (partial), T5.7.1 (partial)
What this means
MITRE ATT&CK T1005
Reads from Microsoft Graph
Licence needed INTUNE_A

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Every Windows device should be encrypted with BitLocker, be covered by an Intune BitLocker policy, and have the recovery key of its system drive stored in Microsoft Entra ID. A lost or stolen laptop without BitLocker gives away its data. A device whose key is not in Entra ID cannot be unlocked by the helpdesk when BitLocker asks for the key.

The test lists each device with what is wrong: not encrypted, no BitLocker policy assigned, or encrypted without a key in Entra ID. Cloud PCs are left out: Windows 365 encrypts their disks itself.

Remediation action

Section titled “Remediation action”
  1. In the Microsoft Intune admin center, go to Endpoint security > Disk encryption.
  2. Make sure a BitLocker policy is assigned to these devices, with Require Device Encryption on and recovery information stored in Entra ID.
  3. For an encrypted device without a key in Entra ID, run BackupToAAD-BitLockerKeyProtector on the device, or make the policy back up the key and let the device sync.
Section titled “Related links”

Mito check, based on RKSolutions Intune Anomalies by Roy Klooster. Author: royklo. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.