"Win - OIB - ES - Encryption - D - BitLocker (OS Disk) - v3.7" saves to AD DS?

[BobaFett163978]

Why does "Win - OIB - ES - Encryption - D - BitLocker (OS Disk) - v3.7" save to AD DS? My understanding is that OIB is not for hybrid environments. If the environment is cloud only, safe to toggle off the two AD DS settings?

[tltaylor1]

Hi, good question, and the naming is what makes it confusing. Keep both settings on. They are not hybrid-only, and turning them off in a cloud-only tenant removes the guarantee you want most.

The names come from the BitLocker CSP, which Intune's Settings Catalog exposes as written: "Save BitLocker recovery information to Active Directory Domain Services" and "Do not enable BitLocker until recovery information is stored in AD DS for operating system drives". The CSP documentation states what those do on cloud-joined devices: for Microsoft Entra joined devices, the BitLocker recovery password is backed up to Entra ID; for hybrid joined devices, to both Active Directory and Entra ID. There is no separate "back up to Entra" switch; this is it. Intune's own BitLocker template shows the same two settings with the newer wording, "Save BitLocker recovery information to Microsoft Entra ID" and "Store recovery information in Microsoft Entra ID before enabling BitLocker".

What each one buys you on a cloud-only device:

1. Save recovery information (OSActiveDirectoryBackup, set to store recovery passwords and key packages in the baseline): the recovery password is escrowed to the device object in Entra ID, which is where the Intune admin center reads it from under Recovery keys.
2. Do not enable BitLocker until the information is stored (OSRequireActiveDirectoryBackup, Required in the baseline): encryption waits for a successful escrow. Without it, a device can encrypt before the key reaches Entra, and a failed backup leaves you with an encrypted disk and no recovery password anywhere you can reach.

The CSP documentation also notes that client-driven recovery password rotation, which the baseline enables, only works when both of these are set. Turn them off and rotation silently stops working too.

So for a cloud-only environment the two settings are doing exactly what the baseline intends; the only thing that is hybrid about them is the label.

If this clears it up, please mark the answer as accepted. It helps the next person who reads the label the same way. And if you are curious what I build, my repositories are at github.com/tltaylor1; a ⭐ on anything you find interesting is always appreciated. Good luck with the rollout.

[BobaFett163978]

Thank you for the detailed and informative response!