{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-115-check-charging-and-encryption-progress-when-a-mac-already-has-a-recovery-key/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-115-check-charging-and-encryption-progress-when-a-mac-already-has-a-recovery-key/", "slug": "dse-20260917-115-check-charging-and-encryption-progress-when-a-mac-already-has-a-recovery-key", "url": "https://update.dsesecurity.com/updates/dse-20260917-115-check-charging-and-encryption-progress-when-a-mac-already-has-a-recovery-key/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-115-check-charging-and-encryption-progress-when-a-mac-already-has-a-recovery-key.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-115-check-charging-and-encryption-progress-when-a-mac-already-has-a-recovery-key/" }, "title": "Check charging and encryption progress when a Mac already has a recovery key", "summary": "Can a FileVault recovery key be available before an Intune-managed Mac is encrypted?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:05+00:00", "modified_at": "2026-09-17T16:42:35+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 205, "potentially_affected": "Use this diagnostic check while reviewing the Intune encryption report for a Mac receiving FileVault policy. Record the device's actual encryption state separately from whether a recovery key has been issued.", "dse_recommendation": "DSE recommends checking power, device accessibility and management timing before treating this state as failed escrow or successful encryption.", "primary_source": { "name": "View report details for encryption status of devices managed with Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/device-management/monitor-encryption", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft explains that recovery-key escrow setup can precede the encryption request, producing a temporary reporting state. A locked device or one that has not recently checked in can also affect the reported state. FileVault encryption does not start until the device is charging, so a user can have a recovery key for a device that is not yet encrypted. Microsoft Learn.

\n

Applicability

\n

Use this diagnostic check while reviewing the Intune encryption report for a Mac receiving FileVault policy. Record the device’s actual encryption state separately from whether a recovery key has been issued.

\n

DSE recommendation

\n

DSE recommends checking power, device accessibility and management timing before treating this state as failed escrow or successful encryption. Ask support to collect the current status through the approved workflow and give the device owner clear steps for allowing encryption to proceed.

\n

Verification

\n

Inspect the actual FileVault state after the device is charging and has completed the relevant management interaction. Reconcile that observation with the report and recovery-key availability. Retain only status evidence in the ticket, keep recovery secrets in their protected channel, and leave the rollout item open until the intended encryption outcome is observed.

\n

Official references

\n

Microsoft Learn: Monitor device encryption with Intune. Source reviewed September 17, 2026.

", "content_text": "Source facts\nMicrosoft explains that recovery-key escrow setup can precede the encryption request, producing a temporary reporting state. A locked device or one that has not recently checked in can also affect the reported state. FileVault encryption does not start until the device is charging, so a user can have a recovery key for a device that is not yet encrypted. Microsoft Learn.\nApplicability\nUse this diagnostic check while reviewing the Intune encryption report for a Mac receiving FileVault policy. Record the device’s actual encryption state separately from whether a recovery key has been issued.\nDSE recommendation\nDSE recommends checking power, device accessibility and management timing before treating this state as failed escrow or successful encryption. Ask support to collect the current status through the approved workflow and give the device owner clear steps for allowing encryption to proceed.\nVerification\nInspect the actual FileVault state after the device is charging and has completed the relevant management interaction. Reconcile that observation with the report and recovery-key availability. Retain only status evidence in the ticket, keep recovery secrets in their protected channel, and leave the rollout item open until the intended encryption outcome is observed.\nOfficial references\nMicrosoft Learn: Monitor device encryption with Intune. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nMicrosoft explains that recovery-key escrow setup can precede the encryption request, producing a temporary reporting state. A locked device or one that has not recently checked in can also affect the reported state. FileVault encryption does not start until the device is charging, so a user can have a recovery key for a device that is not yet encrypted. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-management/monitor-encryption).\n\n## Applicability\n\nUse this diagnostic check while reviewing the Intune encryption report for a Mac receiving FileVault policy. Record the device’s actual encryption state separately from whether a recovery key has been issued.\n\n## DSE recommendation\n\nDSE recommends checking power, device accessibility and management timing before treating this state as failed escrow or successful encryption. Ask support to collect the current status through the approved workflow and give the device owner clear steps for allowing encryption to proceed.\n\n## Verification\n\nInspect the actual FileVault state after the device is charging and has completed the relevant management interaction. Reconcile that observation with the report and recovery-key availability. Retain only status evidence in the ticket, keep recovery secrets in their protected channel, and leave the rollout item open until the intended encryption outcome is observed.\n\n## Official references\n\n[Microsoft Learn: Monitor device encryption with Intune](https://learn.microsoft.com/en-us/intune/device-management/monitor-encryption). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-115-check-charging-and-encryption-progress-when-a-mac-already-has-a-recovery-key/", "url": "https://update.dsesecurity.com/updates/dse-20260917-115-check-charging-and-encryption-progress-when-a-mac-already-has-a-recovery-key/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-115-check-charging-and-encryption-progress-when-a-mac-already-has-a-recovery-key/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check charging and encryption progress when a Mac already has a recovery key", "item": "https://update.dsesecurity.com/updates/dse-20260917-115-check-charging-and-encryption-progress-when-a-mac-already-has-a-recovery-key/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-115-check-charging-and-encryption-progress-when-a-mac-already-has-a-recovery-key/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-115-check-charging-and-encryption-progress-when-a-mac-already-has-a-recovery-key/", "url": "https://update.dsesecurity.com/updates/dse-20260917-115-check-charging-and-encryption-progress-when-a-mac-already-has-a-recovery-key/", "headline": "Check charging and encryption progress when a Mac already has a recovery key", "description": "Can a FileVault recovery key be available before an Intune-managed Mac is encrypted?", "abstract": "Can a FileVault recovery key be available before an Intune-managed Mac is encrypted?", "articleBody": "Source facts\nMicrosoft explains that recovery-key escrow setup can precede the encryption request, producing a temporary reporting state. A locked device or one that has not recently checked in can also affect the reported state. FileVault encryption does not start until the device is charging, so a user can have a recovery key for a device that is not yet encrypted. Microsoft Learn.\nApplicability\nUse this diagnostic check while reviewing the Intune encryption report for a Mac receiving FileVault policy. Record the device’s actual encryption state separately from whether a recovery key has been issued.\nDSE recommendation\nDSE recommends checking power, device accessibility and management timing before treating this state as failed escrow or successful encryption. Ask support to collect the current status through the approved workflow and give the device owner clear steps for allowing encryption to proceed.\nVerification\nInspect the actual FileVault state after the device is charging and has completed the relevant management interaction. Reconcile that observation with the report and recovery-key availability. Retain only status evidence in the ticket, keep recovery secrets in their protected channel, and leave the rollout item open until the intended encryption outcome is observed.\nOfficial references\nMicrosoft Learn: Monitor device encryption with Intune. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:33:05+00:00", "dateModified": "2026-09-17T16:42:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-115-check-charging-and-encryption-progress-when-a-mac-already-has-a-recovery-key/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-115-check-charging-and-encryption-progress-when-a-mac-already-has-a-recovery-key/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check charging and encryption progress when a Mac already has a recovery key" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 205, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "View report details for encryption status of devices managed with Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/device-management/monitor-encryption" } } ] } }