Data Protection Issues

How to Fix BitLocker Cannot Back Up External Drive Recovery Keys to Azure AD

Adam Davis Oct 10, 2026 870 views

Question details

Users are unable to back up BitLocker recovery keys for encrypted external drives to Azure AD, despite OS drives backing up successfully.

How to Fix BitLocker Not Backing Up External Drive Recovery Keys to Azure AD

Product: Windows 11 BitLocker
Device & OS: Windows 11
Scenario: Attempting to escrow or back up a BitLocker recovery key for a removable or external data drive to an Azure AD joined account.
Observed behavior: BitLocker does not offer the UI option to back up external drive keys to Azure AD, and running PowerShell backup commands results in errors even when BitLocker is enabled.

Before you start

Ensure you are logged in with administrator privileges on an Azure AD-joined Windows 11 device, and verify that the external drive is currently connected and unlocked.

Solution 1Recommended

Manually Add an Azure AD Key Protector via PowerShell

External drives may lack the specific Azure AD key protector required for cloud backup. You must create this protector manually before attempting the backup command.

By default, Windows automatically creates Azure AD key protectors for operating system drives during encryption, but it often skips this step for removable data drives. You can resolve the PowerShell errors by explicitly assigning the correct protector.

Open PowerShell as Administrator

Click the Start menu, type 'PowerShell', right-click the Windows PowerShell app, and select 'Run as administrator'.

Identify the External Drive Letter

Note the drive letter assigned to your encrypted external drive (for example, 'E:').

Add the BitLocker Key Protector

Type the command `Add-BitLockerKeyProtector -MountPoint "E:" -RecoveryPasswordProtector` (replace 'E:' with your drive letter) and press Enter to generate a new numerical password protector.

Retrieve the Key Protector ID

Run `(Get-BitLockerVolume -MountPoint "E:").KeyProtector` to list all protectors. Copy the ID string (including brackets) associated with the newly created RecoveryPassword.

Back Up to Azure AD

Run `Backup-ToAAD-BitLockerKeyProtector -MountPoint "E:" -KeyProtectorId "{YOUR-COPIED-ID}"` to push the recovery key to Azure AD.

Manually Add an Azure AD Key Protector via PowerShell

Intune Policy Limitations: If the backup command still fails, your organization's Microsoft Intune policies may strictly prohibit escrowing removable drive keys. You will need to contact your IT admin to adjust the Endpoint Protection configuration.

Solution 2

Use Local Alternative Backup Methods

If Azure AD backup is unsupported for your specific drive type or restricted by group policy, manually export the recovery key to a secure local or offline location.

Free Microsoft Office alternative

Boost Your Productivity with WPS Office

While resolving Windows encryption policies, you might also be looking for a seamless, cost-effective way to manage your documents. WPS Office is a lightweight, fully compatible alternative to Microsoft Office that meets all your professional needs without hefty subscription fees.

1. Download WPS Office: Visit the official WPS website and download the free installation package for Windows.
2. Install the Software: Run the installer and follow the on-screen instructions to complete the setup in minutes.
3. Open and Edit Files: Launch WPS Office and instantly open your existing Microsoft Office documents with perfect formatting.

Free and lightweight office suite with minimal system resource consumptionFully compatible with Microsoft Word, Excel, and PowerPoint formatsBuilt-in PDF editing tools for enhanced document security and managementFamiliar user interface ensuring seamless migration from Microsoft Office

microsoft office alternative - wps office

Frequently Asked Questions

Does Azure AD automatically back up external drive BitLocker keys?

No, Azure AD natively prioritizes backing up keys for operating system drives. Removable or external data drives typically require manual backup interventions or specific Microsoft Intune policy configurations to escrow keys to the cloud.

How do I check if my external drive has a BitLocker key protector?

Open Command Prompt as an Administrator and run `manage-bde -protectors -get E:` (replacing 'E:' with your external drive letter). This will display all active key protectors assigned to that specific drive.

Can Intune policies force BitLocker backups for removable drives?

Yes, administrators can use Endpoint Security policies in Microsoft Intune to configure Disk Encryption settings. They can enforce rules that block write access to removable drives unless they are encrypted and the key is successfully escrowed to Azure AD.

Why does PowerShell return an error when backing up the key?

PowerShell errors during key backup usually occur if the external drive does not have a valid Recovery Password key protector assigned, if the device is experiencing Azure AD sync issues, or if an organization policy actively blocks removable drive key escrow.

Microsoft Office Security Issues