This post has been republished via RSS; it originally appeared at: New blog articles in Microsoft Tech Community.
We were recently alerted that some devices are failing to rotate their FileVault recovery key. There are three paths to rotating the FileVault recovery key for macOS in the Microsoft Endpoint Manager admin center : Using the ‘Rotate FileVault recovery key’ device action, uploading a recovery key to the Company Portal website, or using the ‘Personal recovery key rotation’ setting. If you're experiencing issues with any of these methods, users can manually rotate and store their recovery key by running this command line tool with their password:
More details on each scenario below.
Use ‘Rotate FileVault recovery key’ device action
The ‘Rotate FileVault recovery key’ device action is found under Devices > [select device] > Overview.
The following error may occur after selecting this action:
Upload FileVault recovery key to the Company Portal website
The FileVault recovery key can also be rotated when a user uploads their current recovery key to the Company Portal website. This is found under https://portal.manage.microsoft.com > Devices > [select device] > Store Recovery Key:
After saving this, the following error may occur:
As a result of this error, the key will not rotate and will still be valid; however, the key will not be stored in Intune until the command line tool provided above is run. The Company Portal will still contain the valid key.
Personal recovery key rotation setting
The ‘Personal recovery key rotation’ setting is configured under Device configuration - Profiles > Endpoint protection > FileVault:
When a device is targeted by this profile and fails to rotate its recovery key, you’ll see the following error:
When this error occurs, the recovery key will not rotate and will still be valid.
Apple is aware of the issue, but we don’t have any updates on timeline for any changes. As mentioned above, in the interim, users can manually rotate and store their recovery key by running this macOS command line tool with their password:
We will continue to update this post as new information becomes available. If you have questions or comments for the Intune team, reply to this post or reach out to @IntuneSuppTeam on Twitter.