Bring an already encrypted Mac under Intune FileVault management

Source facts

Intune can take over management of FileVault encryption that a user enabled before receiving its policy. Both documented adoption methods require an active Intune FileVault policy. A user who knows the current recovery key can upload it through Company Portal; Intune validates it, rotates it, and escrows the replacement. The alternative generates a new key on the device before check-in. Microsoft Learn.

Applicability

Review this path for a previously encrypted Mac joining the managed fleet. Confirm device access, applicable enrollment requirements, policy delivery, and the user’s ability to supply or regenerate the key before scheduling the handoff.

DSE recommendation

Treat encryption state and management adoption as separate acceptance items. Select the documented method with the device owner, arrange a protected recovery-key handling path, and preserve access to the device while verifying the newly escrowed current key. Do not plan to recover with the previous key after rotation. Do not ask users to paste recovery material into a support ticket or infer successful adoption from an encrypted-disk indicator.

Verification

After the chosen procedure, verify the encryption report and recovery-key availability through the documented user retrieval path. Confirm that the user can identify the correct device and retrieve its current key using the approved process. Keep only sanitized outcomes in the change record. If policy delivery or retrieval is unresolved, leave the management handoff open rather than declaring the device fully onboarded.

Official references

Microsoft Learn: Encrypt macOS devices with FileVault using Intune.