AMA: Intune device inventory and analytics

BitLocker Recovery Key storage is the responsibility of each individual device and is triggered *only* at the time that an RK is set (or reset). ON hybrid joined devices, devices attempt to save the key to both locations but only one is required to be deemed a successful key save. Depending on connectivity and various other factors that the device cannot and does not control, the RK may thus only be saved to one of the locations. One recommended path to help here is to choose a single authoritative location (hint: this should be Entra ID) and use a remediation script to force all managed Windows devices to periodically save their keys to Entra ID. (Also note that BitLocker RKs are stored in Entra ID and not Intune.)