Microsoft Confirms It Can Share Windows 11 BitLocker Keys With Law Enforcement

[harlan4096]

Windows 11 Cloud Accounts Change How Encryption Keys Are Handled

Microsoft has confirmed that it will provide BitLocker recovery keys to the Federal Bureau of Investigation if presented with a valid legal request. The confirmation follows reporting that Microsoft supplied encryption keys to law enforcement during a criminal investigation in 2025.

The situation is tied directly to how Windows 11 handles device encryption by default. When a user signs in with a Microsoft Account, the operating system automatically backs up the device’s BitLocker recovery key to Microsoft’s cloud unless the user explicitly chooses another option during setup.

Why Microsoft Can Access BitLocker Keys

BitLocker Keys Are Stored With Microsoft Accounts

BitLocker encrypts the data on a Windows PC to protect it if the device is lost or stolen. To prevent permanent data loss, Windows 11 ties the recovery key to the user’s Microsoft Account by default.

This design allows users to recover their data if they are locked out of their PC. It also means Microsoft can access the key stored in its cloud systems when required by law.

Microsoft told Forbes that it receives around 20 requests per year from the FBI for BitLocker recovery keys. In most cases, Microsoft cannot comply because the key was never uploaded. When the key is stored in the cloud, however, Microsoft can provide it.

Legal Requests And Privacy Implications

Microsoft says it only hands over recovery keys when presented with valid legal orders. A company spokesperson stated that while cloud key recovery offers convenience, it also involves trade-offs, and customers are ultimately responsible for deciding how their encryption keys are managed.

The approach differs from some other technology companies. Apple, for example, has publicly resisted law enforcement requests when it does not have technical access to encrypted data. In contrast, Microsoft’s design allows access because the recovery keys are not end-to-end encrypted in a way that prevents the company itself from seeing them.

Continue Reading...