Store disk recovery keys somewhere other than the encrypted laptop, under control of your organisation, and test retrieval before you need it. Apple and Microsoft both build escrow options into their tools, so most teams do not need to invent a system. They need to choose one and write it down.
Why this is a real decision
Disk encryption works because without the right credential the data is unreadable. That includes you. Apple warns that if you lose your login password and recovery key, your files and settings are lost forever. A recovery key is the break glass copy, so it is also the thing an attacker would want.
You are balancing two failures: nobody can recover the disk, or the wrong person can.
What the vendors offer
Apple FileVault. When you turn it on you can recover through your iCloud account, or through a generated recovery key. Apple says to keep the key somewhere other than the encrypted startup disk, and not with the Mac. On business or school Macs the institution can also set a recovery key.
Windows. Microsoft's device encryption backs up the recovery key to Microsoft Entra ID or Active Directory for joined devices, or to a Microsoft account for others. If a device needs the key, the user retrieves it from another device using their account credentials.
Options compared
- Personal cloud account. Easy, and a poor fit for company laptops. Access follows the person, not the company, and it disappears when they leave.
- Organisation controlled escrow. The identity provider or device management holds the key. Best for company owned laptops, as long as access to the escrow is itself well protected.
- Password manager vault with restricted access. Workable for small teams without device management. Limit who can view the entry and turn on its audit log.
- Printed copy in a safe. Fine as a last resort, awkward for remote staff.
- Written on a sticky note under the laptop. No.
A simple policy
- Company laptops escrow keys to a system the company controls, never to a personal account.
- Name an owner for that system and two people who can retrieve a key.
- Test recovery once per quarter on a spare device or a volunteer laptop.
- Record retrieval events. A recovery key being viewed is an event worth a look.
- When someone leaves, retire their keys together with the device. See the offboarding checklist for developer laptops.
- If a key might have been exposed, rotate it. Both ecosystems let you generate a new one after decrypting access.
Check the exact rotation steps for your operating system version in vendor documentation, because menus and commands change between releases.
Quick check
Is an iCloud based FileVault recovery acceptable for company Macs?
It is convenient for individuals, but for company laptops an organisation held recovery key is usually the better fit, since access then does not depend on a personal account.
Sources
Last reviewed: 19 October 2026.
