FileVault Recovery Key Escrow MDM: A Texas IT Playbook

FileVault encrypts the data at rest on a Mac's startup volume. If the machine is off or locked and someone pulls the drive or boots from an external disk, they get nothing but ciphertext. It does not protect against a logged-in session, a phished credential, or malware running while the user is active. It's one layer, not the whole stack — pair it with endpoint protection and proper access controls, which is where our endpoint security work usually starts for Mac fleets.

The gap most Texas small and mid-size businesses have isn't turning FileVault on manually on a handful of Macs. It's doing it consistently across every device, keeping the keys somewhere IT can actually reach, and rotating them when someone leaves. That's a fleet management problem, and the fix is MDM.

Apple built FileVault enforcement and escrow directly into device management. Per Apple's own deployment guide, an MDM profile can require FileVault during Setup Assistant and hold the Mac in an "awaiting configuration" state until encryption is confirmed on — the user literally cannot finish setting up the machine without it turning on. On macOS 26.4 and later, Apple made this even simpler: FileVault is enabled during Setup Assistant by default, no separate payload required.

There's one personal recovery key per encrypted volume. When escrow is configured, the Mac encrypts that key using a certificate supplied by your MDM and sends it up for safekeeping. Your MDM can rotate the key on demand — useful after an offboarding, a suspected compromise, or just as routine hygiene. None of this works if the MDM profile isn't deployed and the escrow certificate isn't trusted, so this is worth verifying rather than assuming it's configured correctly from day one.

For a brand-new Mac enrolled through Automated Device Enrollment, forcing FileVault is straightforward: the MDM profile requires it during Setup Assistant, and on current OS versions it's largely automatic anyway. The harder case is the fleet of Macs your team is already using — the ones bought over the last three years, enrolled at some point, sitting in people's bags right now.

For those, FileVault enablement is deferred until the next logout or login event. That means pushing the policy isn't enough on its own. You need users to actually log out and back in, or restart, before encryption kicks in. We generally tell clients to pair the policy push with a short, polite heads-up: "your Mac will prompt for a restart in the next few days to finish a security update — please don't skip it." Most people comply when you explain why instead of just forcing a reboot on them.

If your Mac fleet is managed through Intune, the configuration path is specific and worth following exactly. Go to Endpoint security, then Disk encryption, then Create Policy. Choose macOS as the platform and the MacOS FileVault profile type.

Inside that profile, turn on FileVault enforcement, set a recovery key rotation interval — annual is a reasonable default, shorter if you're in a regulated industry — and configure the escrow location message. This is the text users see when the recovery key gets escrowed; point it to the Company Portal website so people have a clear, documented way to understand where their key lives if they ever need to ask for it. Assign the policy to the right device group, confirm it reports as applied in Intune, and move on to the next batch.

None of this replaces good device hygiene elsewhere. We still recommend keeping an accurate inventory through asset management so you know which serial numbers are enrolled, encrypted, and current — a policy that's silently failing on ten machines you don't know about does nobody any good.

Here's the step almost everyone skips: testing that you can retrieve an escrowed key before the day you actually need one. Pick a test machine, pull its recovery key from the console the way you would in a real incident, and confirm it unlocks the volume. If your help desk process has a gap — wrong permissions, an expired certificate, an admin who left the company and took institutional knowledge with them — you want to find that during a drill, not during an actual lost-laptop incident at 4:45 on a Friday.

This is also a good moment to document the retrieval process somewhere your help desk team can follow without guessing. Who has access to pull keys? What's the approval step? How fast can it happen after hours? Write it down once and you save yourself a scramble later.

Texas SB 2610, effective September 1, 2025, shields a business with 20 to 99 employees from exemplary damages in a breach lawsuit if it has implemented the CIS Controls IG1 safeguard set — it bars exemplary damages specifically and doesn't create a new right to sue, per the bill text itself. Device encryption and key management sit squarely inside that kind of documented security program. If you're already subject to HIPAA or the FTC Safeguards Rule, enforced FileVault with proper escrow is one of the more straightforward boxes to check — it's a policy push, not a rewrite of your network.

For deeper background on how Apple designed this system, Apple's own FileVault device management guide and Microsoft's Intune FileVault documentation are worth bookmarking for your own reference.

Does FileVault slow down a Mac noticeably?

On any Mac with Apple silicon or a reasonably modern SSD, the performance hit is negligible. Encryption happens via dedicated hardware, not software overhead competing for CPU cycles.

What happens if a user forgets their login password but the key is escrowed?

Your IT team pulls the recovery key from the MDM console, uses it to unlock the volume, and resets the local password. This is exactly the scenario escrow exists for — without it, that machine is effectively bricked.

Can we require FileVault without using an MDM at all?

Technically yes, by enabling it manually per machine, but then there's no central escrow, no rotation, and no enforcement if a user turns it off. For any fleet beyond a handful of devices, that approach falls apart fast.

Does this work for Windows machines too?

The Windows equivalent is BitLocker, managed through similar Intune disk encryption policies. The concepts — enforce, escrow, rotate, test — carry over directly. See our broader notes on Windows and Mac management and known platform vulnerabilities for more context.

How often should recovery keys rotate?

Annually is a sane baseline for most businesses. Rotate immediately after any offboarding of someone with administrative access or after a suspected device compromise.

If you're not sure whether your Mac fleet is actually enforcing FileVault, or whether anyone could pull a recovery key right now if they needed to, that's a quick thing to check and an easy thing to get wrong. Start with a free IT assessment or reach out directly and we'll walk your current MDM policies against what Apple and Microsoft actually recommend.