Can Endpoint Security Manager Rotate BitLocker Recovery Keys in Intune?

MD-102 By islever Editorial Last updated Sep 23, 2026

Short answer

A Yes; the built-in Endpoint Security Manager RBAC role includes Remote tasks with Rotate BitLockerKeys (preview), letting User1 rotate keys.

Question

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have a Microsoft 365 E5 subscription. The subscription contains devices that are Microsoft Entra joined and enrolled in Microsoft Intune. You create a user named User1. You need to ensure that User1 can rotate BitLocker recovery keys by using Intune. Solution: From the Microsoft Intune admin center, you assign the Endpoint Security Manager role to User1. Does this meet the goal?

Yes Correct Answer
No

Key Takeaways

The question tests which built-in Intune RBAC roles carry the Remote tasks permission with Rotate BitLockerKeys (preview) set to Yes — the trap is assuming only Help Desk Operator qualifies, or inventing a role named 'Endpoint Security Administrator'.

Endpoint Security Manager is a built-in Microsoft Intune RBAC role whose permission set includes the Remote tasks right Rotate BitLockerKeys (preview), so assigning it to User1 does let them rotate BitLocker recovery keys. This page establishes that the solution meets the goal, making Yes (A) the correct verdict despite the source key and vote majority favoring No.

Common mistake: The most common wrong pick is No (B), based on the belief that Endpoint Security Manager cannot rotate BitLocker keys and that a role called 'Endpoint Security Administrator' is required; Microsoft Learn lists Endpoint Security Manager as a built-in role that includes the Rotate BitLockerKeys (preview) remote task.

Expert Analysis

Why the Answer Is Correct

Microsoft's guidance for managing BitLocker in Intune says an account must hold an Intune RBAC role whose Remote tasks permission includes the "Rotate BitLockerKeys (preview) right set to Yes", and the built-in Endpoint Security Manager role is one of the roles that carries it. The endpoint security role-permission documentation for Endpoint Security Manager explicitly lists Remote tasks: Rotate BitLockerKeys (Preview) alongside Rotate FileVault key, so User1's single role assignment supplies exactly the capability the scenario requires. Nothing else in the scenario blocks the action: User1 is a user in the same Microsoft 365 E5 tenant as the Microsoft Entra joined, Intune-enrolled devices. Because the required right is present in the assigned role, the solution does meet the goal, so the answer is Yes (A).

Why the Other Options Are Wrong

Option B (No) rests on the claim that Endpoint Security Manager has no BitLocker key-rotation right and that only Help Desk Operator — or some other role — does; that claim is contradicted by the documented permission set for the role. Some learners instead insist the assignment must be to a role called 'Endpoint Security Administrator', but no such built-in Intune RBAC role exists; the built-in security role is named Endpoint Security Manager. A 'No' verdict is only valid when the named role lacks the Rotate BitLockerKeys right, which is not the case here. Since the question offers only Yes/No, B is the single alternative and it fails on the role's actual permissions.

Community Comment Notes

Knight_Of_Peace quoted the doc fragment "Rotate BitLockerKeys (preview) right set to Yes" and answered No, yet the same passage lists Endpoint Security Manager among the built-in roles that include that right. correction and ExamBud argue Yes, with ExamBud noting "the Endpoint security Manager can rotate Bitlocker keys (also Help Desk Operator)" and linking the endpoint-security permissions page. diazed and DPAJA counter with "The role is Endpoint Security Administrator not Endpoint Security Manager", but that role name does not exist in Intune RBAC. The 62% No / 38% Yes split shows learners judging the role by its title rather than its documented permissions.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

For 'does this meet the goal?' case-study items, identify the exact permission the task needs — here Remote tasks > Rotate BitLockerKeys (preview) — and check whether the named role actually grants it instead of judging by the role's title. Microsoft Learn lists both Help Desk Operator and Endpoint Security Manager as built-in roles that include this right.

Frequently Asked Questions

Why do many learners say No for the Endpoint Security Manager role in this scenario?

They assume only Help Desk Operator holds the Rotate BitLockerKeys right, but Microsoft Learn lists Endpoint Security Manager with the same Rotate BitLockerKeys (preview) remote task.

Is there an 'Endpoint Security Administrator' role in Intune RBAC?

No. Intune's built-in security role is named Endpoint Security Manager; 'Endpoint Security Administrator' is not one of the Intune RBAC built-in roles.

More MD-102 FAQ →

Community Votes

62%

38%

62% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

Knight_Of_Peace 👍 3 Answered B

Correct answer: No "Role-based access controls to manage BitLocker To manage BitLocker in Intune, an account must be assigned an Intune role-based access control (RBAC) role that includes the Remote tasks permission with the Rotate BitLockerKeys (preview) right set to Yes. You can add this permission and right to your own custom RBAC roles or use one of the following built-in RBAC roles that include this right: Help Desk Operator Endpoint Security Administrator" Ref: https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices#:~:text=Windows%20security%20documentation.-,Role%2Dbased%20access%20controls%20to%20manage%20BitLocker,Endpoint%20Security%20Administrator,-Create%20and%20deploy
correction 👍 2 Answered A

Permissions granted by the Endpoint Security Manager role: Remote tasks - Rotate BitLockerKeys (Preview) Rotate FileVault key https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security#permissions-granted-by-the-endpoint-security-manager-role
diazed 👍 2 Answered B

Correct Answer is B, The role is Endpoint Security Administrator not Endpoint Security Manager. https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices#role-based-access-controls-to-manage-bitlocker
XylosSW 👍 1 Answered A

https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control-reference#endpoint-security-manager Remote tasks: Rotate BitLockerKeys (preview) Well: https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices#role-based-access-controls-to-manage-bitlocker To manage BitLocker in Intune, an account must be assigned an Intune role-based access control (RBAC) role that includes the Remote tasks permission with the Rotate BitLockerKeys (preview) right set to Yes. You can add this permission and right to your own custom RBAC roles or use one of the following built-in RBAC roles that include this right: Help Desk Operator Endpoint Security Administrator Both sources confirm that this role can manage Bitlocker (included bitlocker key rotation) Answer: A
Meek_Learner 👍 1 Answered B

The Endpoint Security Manager role in Microsoft Intune provides permissions to manage security policies and settings, but it does not grant permissions specifically to rotate BitLocker recovery keys. To ensure User1 can rotate BitLocker recovery keys, they need to be assigned a role with the appropriate permissions. The "Help Desk Administrator" role in Microsoft Entra ID (formerly Azure AD) or a custom role in Intune with the "Rotate BitLocker Keys" permission would be more appropriate.

Show 4 more comments

Grimmgore 👍 1 Answered B

Role-based access controls to manage BitLocker To manage BitLocker in Intune, an account must be assigned an Intune role-based access control (RBAC) role that includes the Remote tasks permission with the Rotate BitLockerKeys (preview) right set to Yes. You can add this permission and right to your own custom RBAC roles or use one of the following built-in RBAC roles that include this right: Help Desk Operator Endpoint Security Administrator
ExamBud 👍 1 Answered A

According to this, the Endpoint security Manager can rotate Bitlocker keys (also Help Desk Operator): https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control-reference#endpoint-security-manager
dddba0a 👍 1 Answered A

https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security go to the Manage devices para
DPAJA 👍 1 Answered B

its Endpoint Security Administrator

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide