Help Desk Operator Role BitLocker Rotation

MD-102 By islever Editorial Last updated

Perform remote actions on devices

Short answer

A Assigning the Help Desk Operator role provides the necessary Remote tasks permission to rotate BitLocker recovery keys.

Question

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have a Microsoft 365 E5 subscription. The subscription contains devices that are Microsoft Entra joined and enrolled in Microsoft Intune. You create a user named User1. You need to ensure that User1 can rotate BitLocker recovery keys by using Intune. Solution: From the Microsoft Intune admin center, you assign the Help Desk Operator role to User1. Does this meet the goal?
  1. Yes Correct Answer
  2. No

Key Takeaways

Tests specific RBAC rights for BitLocker; the trap is confusing it with FileVault (macOS) or assuming standard Help Desk roles are insufficient.

Determines if the Help Desk Operator role permits rotating BitLocker keys in Intune. The analysis confirms this role grants the necessary remote action permissions.

Common mistake: Choosing 'No' because users assume Help Desk operators lack security privileges or confuse BitLocker with macOS FileVault rotation.

Expert Analysis

Why the Answer Is Correct

The Help Desk Operator role in Microsoft Intune includes the 'Remote tasks' permission with the 'Rotate BitLockerKeys' right enabled. This allows designated help desk personnel to rotate BitLocker recovery keys for Windows devices managed by Intune, meeting the goal.

Why the Other Options Are Wrong

Selecting 'No' is incorrect because the role does have this capability. Confusion often arises from the fact that the same role also allows rotating FileVault keys for macOS, but it explicitly supports BitLocker for Windows as well.

Community Comment Notes

Community comments reflect a split, with some citing the official documentation that links Help Desk Operator to BitLocker rotation. Others argue against it, possibly due to outdated knowledge or confusion with other roles, but the current documentation supports the 'Yes' verdict.

Official Reference

https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control-reference

This link opens the official vendor documentation in a new tab.

Exam Strategy

Memorize the specific remote actions associated with each built-in Intune RBAC role, particularly distinguishing between BitLocker and FileVault capabilities.

Frequently Asked Questions

Can Help Desk Operator rotate FileVault keys?

Yes, the Help Desk Operator role includes permissions to rotate both BitLocker (Windows) and FileVault (macOS) recovery keys.

Is BitLocker rotation always available?

It may be marked as preview in some contexts, but the Help Desk Operator role is designed to support this remote action.

More MD-102 FAQ →

Community Votes

A
73%
B
27%

73% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. 5e80f0c 👍 7 Answered A
    It seems the given answer is correct: https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control-reference Remote tasks Rotate BitLockerKeys (preview) Remote tasks Rotate filevault key.
  2. SinnCity 👍 2 Answered B
    Answer: No, Help Desk Operator role doesn't have the necessary permissions to rotate Bitlocker recovery keys. It does have permissions to rotate FileVault recovery key used in macOS.
  3. correction 👍 1 Answered A
    Role-based access controls to manage BitLocker To manage BitLocker in Intune, an account must be assigned an Intune role-based access control (RBAC) role that includes the Remote tasks permission with the Rotate BitLockerKeys (preview) right set to Yes. You can add this permission and right to your own custom RBAC roles or use one of the following built-in RBAC roles that include this right: Help Desk Operator Endpoint Security Administrator https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices#role-based-access-controls-to-manage-bitlocker Help Desk Operator Help Desk Operators perform remote tasks on users and devices and can assign applications or policies to users or devices. Remote tasks - Rotate BitLockerKeys (preview) https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control-reference#help-desk-operator
  4. RoyM365 👍 1 Answered B
    I think this answer needs to be also B NO just like question 333

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Assigning Intune and Cloud PC Roles with Least Privilege

S-grade

SCEP Root Certificate Location for Intune

S-grade

How Many Intune Profiles Are Needed for Cloud PKI User Certificates?

S-grade

What Must Be Purchased First for Intune Device Query at Minimum Cost?

S-grade

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide