Use Manage BitLocker → Back up your recovery key → Save to your Microsoft Account, then verify that the displayed key ID matches the newly created recovery-password protector before changing or deleting anything.
Back up the key safely
- Keep the written copy of the new 48-digit password and key ID in a secure location away from the computer.
- Select Start, type BitLocker, and open Manage BitLocker.
- Next to the appropriate drive—normally C:—select Back up your recovery key.
- Select Save to your Microsoft Account, and then select Finish. This is the documented Windows 11 method for saving a recovery key to the recovery-key library of a personal Microsoft account. Creating this additional backup does not require decrypting the drive, and Microsoft supports making multiple backups.^1^
- Open the Microsoft account recovery-key page from another browser or device, sign in with the same personal Microsoft account, and compare the listed key ID with the ID you wrote down. The key ID identifies which 48-digit recovery password belongs to the drive.^2^
Do not delete either recovery-password protector or any online entry while testing this. BitLocker supports saving recovery information to a Microsoft account, file, USB device, or printout.^3^
If the new key ID still does not appear
Microsoft’s personal-account procedure does not document a way to select a particular recovery-password protector when a drive contains multiple such protectors. Therefore, do not assume that repeating Back up your recovery key uploaded the newly added protector unless its key ID appears online.
Use an independent backup for the new protector:
- Keep the written copy securely, or
- In Manage BitLocker → Back up your recovery key, choose Save to a USB flash drive, Save to a file, or Print the recovery key.
- Do not keep the USB drive or printout with the computer. A file cannot be saved to the BitLocker-encrypted drive itself; Microsoft suggests storing a copy in OneDrive Personal Vault if appropriate.^1^
You can also confirm that both recovery-password protectors remain installed without modifying them. Open Terminal (Admin) and run:
manage-bde.exe -protectors -get C: -Type RecoveryPassword
Compare each displayed protector ID and 48-digit password with your written records. The command only displays the configured protectors; it does not remove or replace them.^4^
Commands not to use for a personal Microsoft account
These commands do not upload to a personal Microsoft account:
manage-bde.exe -protectors -aadbackup C: -id {ID}
manage-bde.exe -protectors -adbackup C: -id {ID}
-aadbackup targets Microsoft Entra ID, while -adbackup targets Active Directory Domain Services; they are organizational-directory operations, not personal-account backup methods.^5^
Avoid any command containing -protectors -delete. Deleting protectors is unnecessary for backup and introduces avoidable recovery risk. Keep both protectors until the new key is independently backed up and its copy has been checked character-for-character.
References
- Back Up Your BitLocker Recovery Key | Microsoft Support
- Find your BitLocker recovery key | Microsoft Support
- BitLocker FAQ
- BitLocker operations guide
- manage-bde protectors