Check charging and encryption progress when a Mac already has a recovery key

Source facts

Microsoft explains that recovery-key escrow setup can precede the encryption request, producing a temporary reporting state. A locked device or one that has not recently checked in can also affect the reported state. FileVault encryption does not start until the device is charging, so a user can have a recovery key for a device that is not yet encrypted. Microsoft Learn.

Applicability

Use this diagnostic check while reviewing the Intune encryption report for a Mac receiving FileVault policy. Record the device’s actual encryption state separately from whether a recovery key has been issued.

DSE recommendation

DSE recommends checking power, device accessibility and management timing before treating this state as failed escrow or successful encryption. Ask support to collect the current status through the approved workflow and give the device owner clear steps for allowing encryption to proceed.

Verification

Inspect the actual FileVault state after the device is charging and has completed the relevant management interaction. Reconcile that observation with the report and recovery-key availability. Retain only status evidence in the ticket, keep recovery secrets in their protected channel, and leave the rollout item open until the intended encryption outcome is observed.

Official references

Microsoft Learn: Monitor device encryption with Intune. Source reviewed September 17, 2026.