Help, there’s a Mac on my network (10): the FileVault key nobody has

Episode 10 of the series Help, there’s a Mac on my network.

What happened

Monday morning, first day after the summer holidays. Henk from sales is standing at Ruud’s desk. Tanned, rested, and holding a MacBook Pro the way you’d carry a sick cat to the vet.

“It won’t take my password.”

“Which password did you try?”

“All of them. Including the hotel wifi.”

Ruud puts down his mug. It says “Have you tried turning it off and on again?”, which Henk had, three times. The story comes out in pieces. Henk bought the Mac himself in the spring and set it up on his own, “because how hard can it be”, and only enrolled it in Intune through Company Portal a few weeks later. Three weeks in Crete later, the password he made up back then is gone. Much like his sunscreen, which is still in the hotel room.

Ruud does what twenty years of Windows taught him. Entra admin center, find the device, go to BitLocker keys. Nothing. “In Windows that was just under the device in Entra…”

Sam is looking over Ruud’s shoulder. “Mind if I…? FileVault keys aren’t in Entra, they’re in Intune. But if Henk turned FileVault on himself before the Mac was enrolled, Intune never got the key.” A few clicks later, there it is: encrypted, yes. Recovery key: none.

“Henk, have you got your iPhone? Newer versions of macOS also keep the recovery key in your keychain. It might be in the Passwords app.” Henk looks guilty. iCloud Keychain is off. “I don’t trust the cloud.” On the same iPhone, 4,000 holiday photos are happily living in iCloud.

Ruud looks at the Mac, then at Henk, then at his framed Windows 2000 certificate on the wall. As if it might have an idea.

What’s really going on

First the good news, at least for security. On a Mac with Apple silicon, internal storage is always encrypted, even with FileVault turned off. The key is then protected only by the hardware, in the Secure Enclave. Turn FileVault on and that key is additionally protected by the user’s password. That’s why enabling FileVault on a modern Mac takes seconds. Nothing needs encrypting, you’re just adding a lock.

The bad news is the same story told from the other side. Without the password or a recovery key, you’re not getting in. Apple has no back door, and the old trick of hooking the disk up to another Mac is gone: the SSD is soldered to the board and target disk mode isn’t supported on Apple silicon.

There are three ways around a forgotten password:

• Personal recovery key (PRK). A 24 character code of letters and numbers, created when FileVault is turned on. The user sees it once. According to Apple, macOS also stores it in the keychain, so with iCloud Keychain on it shows up in the Passwords app. Not for Henk, then.
• Recovery via Apple Account. During setup you can let your Apple Account reset the password. Fine at home. For a business it means company data depends on someone’s personal account.
• Institutional recovery key (IRK). One certificate for all your Macs. Sounds like the admin’s dream, but Apple says it plainly: on Apple silicon an IRK has no practical value, because you can’t use it in recoveryOS. Apple no longer recommends it.

What an organisation wants is the personal recovery key stored in its MDM. That’s called escrow, and it’s exactly the same idea as the BitLocker key in Entra. Intune stores the key, can rotate it on a schedule, an admin can look it up and the user can retrieve it from the Company Portal website.

So why did Henk fall through the cracks? Intune escrows a key when an Intune policy turns FileVault on, or when the user uploads the key for a Mac they encrypted themselves. Henk did neither. The policy arrived, saw FileVault was already on, and that was that.

And Platform SSO? It won’t save you here by default. With the Secure Enclave method the local password stays separate from Entra, so resetting the Entra password does nothing for the FileVault lock. With the Password method the Entra password is the local password, but Microsoft notes that a new Entra password only works at the FileVault startup screen from macOS 15 onwards. One more catch: if you reset the password with a recovery key, the Platform SSO keys in the Secure Enclave are lost and the Mac has to register again. Annoying, but survivable.

How to fix it

For Henk: when there really is no key

1. Look everywhere first. Intune (the device, Monitor, Recovery keys), the Company Portal website, the Passwords app on every device signed in to the same Apple Account, and the sticky note in the desk drawer. Enter a wrong password a few times at the login screen: if Apple Account recovery was enabled, the Mac will offer it now.
2. Nothing? Then the data is gone. Not tricky, not expensive, just gone. The sooner everyone accepts that, the sooner Henk is back at work.
3. Check what’s safe elsewhere. This was Sam’s moment. While Ruud was still consulting the certificate, Sam had already checked the OneDrive overview and seen that Henk’s Desktop and Documents were covered by OneDrive folder backup. Mail lives in Exchange, quotes in SharePoint. Lost: a Downloads folder full of PDFs and a playlist called “Crete 2026”.
4. Erase the Mac. Shut it down, hold the power button until you see Options, and start Recovery. If you can’t get further without a password, choose Erase Mac from the Recovery Assistant menu. Then reinstall macOS from Recovery.
5. Mind Activation Lock. If Find My was on with Henk’s personal Apple Account, the Mac will ask for that account after the erase. Luckily Henk does know that password, it’s on his iPhone. You can also remove the Mac beforehand via Find Devices on iCloud.com. If nobody knows it, your only route is Apple Support with proof of purchase. Which is exactly why you want company Macs to come in through Apple Business, not hanging off someone’s personal account.
6. Enroll the Mac again, this time with a FileVault policy that escrows the key from day one.

For everyone else: make sure there’s always a key

1. Create a FileVault policy. In Intune: Endpoint security, Disk encryption, Create Policy, platform macOS, profile macOS FileVault. Turn Enable on and set Use Recovery Key to Enabled. Under Location, add something like “Find your recovery key at portal.manage.microsoft.com under Devices”. Set Recovery Key Rotation In Months, for example to 6.
2. New Macs via Apple Business: with the settings catalog you can enforce FileVault during Setup Assistant (Force Enable in Setup Assistant, with Defer set to Enabled and Await final configuration in your enrollment profile). Works from macOS 14.
3. Existing Macs like Henk’s need Intune to take over. Option one: the user goes to the Company Portal website, picks the Mac and chooses Store recovery key, enters the current key, and Intune validates and rotates it. Option two: the user runs sudo fdesetup changerecovery -personal in Terminal, gets a new key, and Intune picks it up at the next sync.
4. Set ownership to Corporate. A Mac enrolled through Company Portal often shows up as Personal. On personal devices, admins can’t view the key.
5. Verify it. Check the encryption report under Devices, Monitor. Open the recovery key per Mac (that gets logged, which is fine). Have a user retrieve their key once from Company Portal, and test it on the Mac with sudo fdesetup validaterecovery.
6. Make it mandatory with a compliance policy that requires encryption.

Ruud’s lesson

A key that only lives in someone’s head isn’t a key, it’s a guess. And heads go on holiday. That afternoon Ruud switched on the FileVault policy, checked every Mac, and stuck a note on his monitor: “Entra is for BitLocker. Intune is for FileVault. Henk is for sales.”

Further reading: Apple Business, Entra ID and Intune and Mac in a Windows network.

This is episode 10 of Help, there’s a Mac on my network. Need help with Macs in your organisation? Email frank@analystict.nl.