Can Helpdesk Administrator rotate BitLocker recovery keys in Intune?

MD-102 By islever Editorial Last updated

Short answer

B Helpdesk Administrator is a Microsoft Entra role; rotating BitLocker recovery keys in Intune needs an Intune RBAC role with the Rotate BitLockerKeys permission.

Question

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have a Microsoft 365 E5 subscription. The subscription contains devices that are Microsoft Entra joined and enrolled in Microsoft Intune. You create a user named User1. You need to ensure that User1 can rotate BitLocker recovery keys by using Intune. Solution: From the Microsoft Entra admin center, you assign the Helpdesk Administrator role to User1. Does this meet the goal?
  1. Yes
  2. No Correct Answer

Key Takeaways

This tests whether a Microsoft Entra role assignment grants an Intune remote task; the trap is confusing Helpdesk Administrator with the Intune Helpdesk Operator RBAC role that has the Rotate BitLockerKeys right.

A Microsoft 365 E5 subscription has Microsoft Entra joined and Intune-enrolled devices, and User1 must rotate BitLocker recovery keys from Intune. The proposed assignment of the Microsoft Entra Helpdesk Administrator role is insufficient; the answer is No because Intune RBAC requires the Rotate BitLockerKeys permission.

Common mistake: Choosing Yes because Helpdesk Administrator sounds like a helpdesk role; in MD-102, Intune remote tasks require Intune RBAC permissions, not just an Entra admin role.

Expert Analysis

Why the Answer Is Correct

The goal is not merely to view or recover BitLocker keys; User1 must rotate BitLocker recovery keys through Intune. Microsoft Intune controls that action with its own RBAC model, and the role must include the Remote tasks permission with the Rotate BitLockerKeys right. Microsoft Entra Helpdesk Administrator is a directory role, not an Intune RBAC role, so assigning it does not grant the Intune remote task. Therefore, the solution does not meet the goal, making "No" correct.

Why the Other Options Are Wrong

Option A ("Yes") is incorrect because it assumes any helpdesk-style role can perform Intune remote actions. Helpdesk Administrator may help with Entra directory tasks and certain recovery-key reads, but it does not include Intune's Rotate BitLockerKeys permission. The correct approach is a built-in Intune role such as Helpdesk Operator or a custom Intune role that has the needed Remote tasks right.

Community Comment Notes

Knight_Of_Peace cites Microsoft guidance that an account must have an Intune RBAC role with the "Rotate BitLockerKeys (preview) right set to Yes," which matches the tested requirement. diazed similarly notes "Helpdesk Operator is the role required to rotate Bitlocker Keys, not HelpDesk Administrator." A minority (CornFlakes3D, SinnCity) voted Yes, but their reasoning conflates Entra role capabilities with Intune RBAC authorization. The 75–25 vote split reflects that common trap.

Official Reference

https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices#role-based-access-controls-to-manage-bitlocker

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question asks about Intune remote actions, distinguish Microsoft Entra administrative roles from Intune RBAC roles. The proposed solution must name an Intune role or permission, not an Entra role that only manages directory objects or Entra key data.

Frequently Asked Questions

Why doesn't Helpdesk Administrator allow BitLocker key rotation in Intune?

It is a Microsoft Entra directory role, while Intune key rotation requires an Intune RBAC role with the Remote tasks Rotate BitLockerKeys permission, such as Helpdesk Operator.

Which Intune role can rotate BitLocker recovery keys?

Built-in Intune roles such as Helpdesk Operator include the Rotate BitLockerKeys right, or you can use a custom Intune RBAC role with that Remote tasks permission enabled.

More MD-102 FAQ →

Community Votes

B
75%
A
25%

75% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. Knight_Of_Peace 👍 2 Answered B
    Correct answer: No "Role-based access controls to manage BitLocker To manage BitLocker in Intune, an account must be assigned an Intune role-based access control (RBAC) role that includes the Remote tasks permission with the Rotate BitLockerKeys (preview) right set to Yes. You can add this permission and right to your own custom RBAC roles or use one of the following built-in RBAC roles that include this right: Help Desk Operator Endpoint Security Administrator" Ref: https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices#:~:text=Windows%20security%20documentation.-,Role%2Dbased%20access%20controls%20to%20manage%20BitLocker,Endpoint%20Security%20Administrator,-Create%20and%20deploy
  2. diazed 👍 2 Answered B
    Correct Answer is B, Helpdesk Operator is the role required to rotate Bitlocker Keys, not HelpDesk Administrator. https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices#role-based-access-controls-to-manage-bitlocker
  3. correction 👍 1 Answered B
    Role-based access controls to manage BitLocker To manage BitLocker in Intune, an account must be assigned an Intune role-based access control (RBAC) role that includes the Remote tasks permission with the Rotate BitLockerKeys (preview) right set to Yes. You can add this permission and right to your own custom RBAC roles or use one of the following built-in RBAC roles that include this right: Help Desk Operator Endpoint Security Administrator https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices#role-based-access-controls-to-manage-bitlocker Help Desk Operator Help Desk Operators perform remote tasks on users and devices and can assign applications or policies to users or devices. Remote tasks - Rotate BitLockerKeys (preview) https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control-reference#help-desk-operator
  4. SinnCity 👍 1 Answered A
    Yes, the Helpdesk Administrator role can rotate BitLocker recovery keys using Intune. This role has the necessary permissions to manage BitLocker recovery keys, including the ability to rotate them.
  5. CornFlakes3D 👍 1 Answered A
    A is correct https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices#role-based-access-controls-to-manage-bitlocker
Show 1 more comment
  1. Seek12 👍 1 Answered B
    helpdesk role does not have enough perms

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Assigning Intune and Cloud PC Roles with Least Privilege

S-grade

SCEP Root Certificate Location for Intune

S-grade

How Many Intune Profiles Are Needed for Cloud PKI User Certificates?

S-grade

What Must Be Purchased First for Intune Device Query at Minimum Cost?

S-grade

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide