INTUNE ADMIN LAB - CASE 06
BitLocker recovery keys in Intune: which one is current?
Blank worksheet. Record observations; do not assume a test passed.

CORE EXERCISE: IDENTIFY THE CURRENT RECOVERY RECORD
Windows session available? Yes / No (if No, use the recovery-screen incident branch)
Expected computer:
Intune managed device ID:
Microsoft Entra device ID (different from the Intune ID):
Operator:
Last Intune check-in (include timezone):
Local observation time (UTC):
Local VolumeStatus / ProtectionStatus / EncryptionPercentage:
RecoveryPassword protector ID(s) on the OS volume:
Matching full key ID(s) listed for the same Entra device:
Full-ID source: Portal / Metadata-only Graph query / Other
Metadata query result and observation time, if used:
Other cloud records absent from the current local ID set:
Evidence file/reference:

OPTIONAL CONFIGURATION INVESTIGATION (NOT REQUIRED TO CLOSE A VERIFIED ID MATCH)
Device join type and matching Entra device ID:
Windows edition:
Applicable management entitlement, if considering a policy change:
Last manual device sync time, if known:
PolicyManager current device BitLocker path: Present / Absent / Read failed / Not checked
Provider-specific BitLocker path(s) and matching management connection:
FVE path and selected policy values:
MDM report time and relevant BitLocker configuration:
Sync-window events, IDs and error codes:
Selected values observed (missing is not the same as disabled):
Policy assignment and per-setting results checked:
Other possible configuration sources or evidence gaps:

CLOSE THE KEY-IDENTIFICATION TICKET
[ ] Correct device identified using full device IDs.
[ ] Current local recovery protector ID(s) recorded.
[ ] Full ID match or mismatch with Entra documented.
[ ] Local encryption and protection state recorded separately.
[ ] Conclusions distinguish the stored record from password access and recovery.
Actual result: Matched / No match / Incomplete
Next action, if required:
Conclusion supported by the evidence:

OPTIONAL FOLLOW-UP A: PASSWORD ACCESS AND AUDIT
Run only if separately in scope, using an authorised operator.
Permission to list metadata:
Permission to reveal the recovery password:
Actual retrieval outcome:
Denied-access operator and actual outcome, if tested:
Read BitLocker key audit event, actor and time, if tested:
Actual status: Not run / Pending / Verified / Failed
If handling a locked device: recovery-screen key ID, verified requester and device ownership:
Approved channel for password handover (record the channel, not the password):
Recovery trigger and post-recovery follow-up:
DO NOT paste a 48-digit recovery password, access token or secret here.

OPTIONAL FOLLOW-UP B: MANAGED ROTATION
Run only after applicable licensing, permissions and effective policies are verified.
[ ] Device is Entra joined or hybrid joined and runs a supported Windows version.
[ ] Applicable management entitlement and rotation permission verified.
[ ] Current local recovery protector matches a stored cloud record.
[ ] Recovery procedure and an authorised recovery operator are available.
[ ] Device is connected and Windows is accessible.
[ ] Client-driven rotation is enabled for this join type.
[ ] Saving recovery information to Entra is enabled and storage before encryption required.
[ ] Effective settings and competing policies checked.
[ ] Scope is the single authorised lab device; baseline saved.
Rotation request time (UTC):
Device action status and time:
New local observation time (UTC):
New local RecoveryPassword protector ID(s):
Old baseline protector ID(s) still on the OS volume:
New key ID(s) present in the same Entra device record:
Local protection after test:
Unexpected result and next check:
Actual status: Not run / Pending / Verified / Failed
Boot recovery tested? Yes / No
Automatic rotation after recovery use tested? Yes / No
Final device/policy state and any retained pilot configuration:

Historical cloud records do not identify the active protector by row order.
A portal action status alone does not establish replacement or backup.
This worksheet records technical evidence; it is not a key vault.