Guides  ·  4 min read

The BitLocker key Intune leaves behind after a wipe

A BitLocker-encrypted Windows laptop goes through an Intune wipe this afternoon. The reset discards the volume's encryption key, which is what a cryptographic erase is supposed to do, and WipeCert's certificate classifies the wipe as NIST 800-88 Purge. But the device may not have held the only copy of that key.

If your BitLocker policy backs recovery keys up to Microsoft Entra ID, a recovery copy of that key was sent there before the wipe ever ran. The Intune wipe does not touch it. The device's own key is gone; the recovery key in Entra ID stays attached to the device object until someone deletes that object.

Why one surviving copy matters

NIST SP 800-88 Rev. 2 is direct about this. It says cryptographic erase should not be trusted on media whose keys have been backed up or escrowed, unless the organization has a high level of confidence about how and where those copies are stored and managed (Sec. 3.2.2). It notes, citing ISO/IEC 27040, that all copies of the target keys must be able to be sanitized, and that a key which exists outside the device could be used in the future to recover the encrypted data (Sec. 3.2.3).

The practical risk is narrow but real. The recovery key can no longer unlock the reset device, but it could still decrypt an image of the drive taken before the wipe: from an earlier compromise, a forgotten backup, or a laptop that passed through other hands before IT got to it. That is why WipeCert certificates issued under Rev. 2 put a condition on an Intune Purge in plain words: the Purge method is met only when no copy of the key exists outside the device. An escrowed recovery key is exactly that copy.

The only way to remove it

Microsoft Graph's BitLocker recovery key API lets you list and read recovery keys. It has no call to delete one. The keys are removed when the device object is deleted from Entra ID, and that is a bigger step than it sounds: it removes the device from your directory, not just the key. For a device being disposed of or handed to a new owner, that is usually what you want. For a device about to be reimaged and redeployed under the same identity, it is not.

That tradeoff is why WipeCert does not do this automatically.

What WipeCert does about it

There is a setting, off by default, that closes this gap for Windows devices. When it is on, a successful Intune wipe on a Windows device triggers a second step: WipeCert deletes that device's object in Entra ID, and the escrowed recovery keys go with it.

• Off by default. Deleting a device object changes your own directory, so it only happens when your organization turns it on.
• Windows only. The point is BitLocker escrow. Phones and Macs are never touched by this step.
• Only after a successful wipe. A wipe that did not complete never triggers it.
• Never holds up the certificate. If the Entra deletion fails for any reason, the certificate still issues, and the failure is recorded on it.

It also never claims a deletion it cannot prove. If the Entra device id on a wipe was carried over from an earlier attempt rather than read fresh, and that id comes back as not found, WipeCert does not report the keys as destroyed. A device that went through the full-disk wipe path can re-enroll under a new identity, so a missing old id says nothing about the keys stored under the new one. That case is recorded as not confirmed.

Whatever happened (destroyed, not attempted because the device was not Windows or had no Entra id on record, or attempted and failed) is written in plain language on the wipe record and carried into the signed certificate. It appears on the public verification page for that certificate, so anyone with the link can check it, not just the person who ran the wipe.

Turning it on

The setting sits with the rest of the Intune configuration under Set up > Microsoft Intune in the dashboard. It is independent of the other Windows-only Intune option, protected wipe, which changes how the reset itself runs rather than what happens to the escrowed key afterward. You can turn on either, both or neither.

For how the Purge or Clear result is decided in the first place, see Intune wipe: Purge or Clear? For the integration as a whole, see the Microsoft Intune integration page.

If your offboarding checklist already asks "was the drive wiped", add the next question: where else does a copy of that key live, and did anything remove it? The free trial includes two wipes and needs no card. The Intune connection is the Intune Add-On, available on any paid plan and included with Enterprise, and new customers can request a 30-day Intune pilot.