How to Recover BitLocker-Protected Azure VMs and Endpoints at Scale

Retrospective: this article looks back at events from July 2024, written in 2026 with the benefit of hindsight.

The CrowdStrike outage showed how hard recovery is when thousands of BitLocker-encrypted devices won't boot. Here is how to prepare for recovering Azure VMs and endpoints at scale.

Part 1: Make recovery keys available

Entra ID–joined and hybrid-joined Windows devices: confirm BitLocker recovery keys are escrowed to Entra ID (visible in the Entra admin center and Intune). Use Intune policies to require key backup before encryption.
Active Directory–joined devices: confirm keys are backed up to AD.
Access control: limit who can read recovery keys; reading them is audited.
Offline access: plan how help desk staff can retrieve keys if your normal tools are down (export procedures, emergency access accounts).

Part 2: Endpoint recovery runbook

Identify affected devices (management console, help desk reports).
Provide users with self-service recovery key access where appropriate (via the My Account portal or Company Portal) for simple fixes.
Use Windows Recovery Environment or bootable media for automated remediation scripts where possible.
Prioritize critical roles and devices.

Part 3: Azure VM recovery

Restore from backup or snapshot taken before the faulty update.
Repair VM approach: attach the affected OS disk to a working repair VM, fix the issue, then reattach. Azure's az vm repair CLI extension automates parts of this.
Serial console for troubleshooting where enabled.
For BitLocker-encrypted Azure VMs using Azure Disk Encryption, keys are in Key Vault — confirm access.

Part 4: Practice

Run a tabletop: "10% of our Windows devices and servers won't boot." Time the recovery steps.

Part 5: Reduce blast radius

Use update rings and staged deployments for security agents and OS updates where vendors support them.