# Check charging and encryption progress when a Mac already has a recovery key

> Can a FileVault recovery key be available before an Intune-managed Mac is encrypted?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-115-check-charging-and-encryption-progress-when-a-mac-already-has-a-recovery-key/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:05+00:00
- Modified: 2026-09-17T16:42:35+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Can a FileVault recovery key be available before an Intune-managed Mac is encrypted?

## Potentially affected

Use this diagnostic check while reviewing the Intune encryption report for a Mac receiving FileVault policy. Record the device's actual encryption state separately from whether a recovery key has been issued.

## DSE recommendation

DSE recommends checking power, device accessibility and management timing before treating this state as failed escrow or successful encryption.

## Article

## Source facts

Microsoft explains that recovery-key escrow setup can precede the encryption request, producing a temporary reporting state. A locked device or one that has not recently checked in can also affect the reported state. FileVault encryption does not start until the device is charging, so a user can have a recovery key for a device that is not yet encrypted. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-management/monitor-encryption).

## Applicability

Use this diagnostic check while reviewing the Intune encryption report for a Mac receiving FileVault policy. Record the device’s actual encryption state separately from whether a recovery key has been issued.

## DSE recommendation

DSE recommends checking power, device accessibility and management timing before treating this state as failed escrow or successful encryption. Ask support to collect the current status through the approved workflow and give the device owner clear steps for allowing encryption to proceed.

## Verification

Inspect the actual FileVault state after the device is charging and has completed the relevant management interaction. Reconcile that observation with the report and recovery-key availability. Retain only status evidence in the ticket, keep recovery secrets in their protected channel, and leave the rollout item open until the intended encryption outcome is observed.

## Official references

[Microsoft Learn: Monitor device encryption with Intune](https://learn.microsoft.com/en-us/intune/device-management/monitor-encryption). Source reviewed September 17, 2026.

## Primary reference

- Name: View report details for encryption status of devices managed with Microsoft Intune - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/device-management/monitor-encryption
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check charging and encryption progress when a Mac already has a recovery key,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-115-check-charging-and-encryption-progress-when-a-mac-already-has-a-recovery-key/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.