# Role-Based Access Controls for BitLocker Management

Last Updated On: 24 Sep 2026

Separate who can configure BitLocker encryption from who can retrieve recovery keys.

## Why split access for BitLocker

Large organizations need to delegate encryption work without opening up every permission at once.

### What RBAC gives you

Managing BitLocker encryption in large organizations requires strict access controls, to prevent unauthorized changes while keeping day-to-day operations smooth. **Role-based access control (RBAC)** lets IT teams delegate encryption management securely, so only designated technicians handle BitLocker configuration and recovery key management.

Endpoint Central MSP's granular access control separates BitLocker encryption configuration from recovery key access, so encryption policies are managed securely while recovery keys stay accessible only to authorized personnel.

## Assigning technician access

Grant a user the BitLocker Manager role, then restrict recovery key access separately.

### Add a user with BitLocker access

1. Go to **Admin → Users** under **User Administration** in the web console.
2. Click **Add User** and assign the **BitLocker Manager** role to grant access to BitLocker encryption settings.
3. Restrict recovery key access under the **Role** tab so only specific users can retrieve recovery keys — see Assigning Technician Role below.

![Add User screen with the BitLocker Manager role assigned.](https://www.manageengine.com/products/desktop-central/help/images/blm-rbac.png)

Assigning the BitLocker Manager role to a user.

## Assigning technician roles

Build a custom role scoped to exactly one of the two BitLocker permission areas.

### Create a custom BitLocker role

1. Go to **Admin → Role** under **User Administration** in the web console.
2. Click **Add Role** and customize the access permissions for the role.

The two BitLocker permission areas are configured independently:

- **Configuration access only** — select **Full Control** for **BitLocker Management (All features)** and unselect **Full Control** for **BitLocker Management (Recovery Key)**.

  ![Role permissions configured for configuration access only.](https://www.manageengine.com/products/desktop-central/help/images/blm-rbac-1.png)

  Configuration-only role permissions.

- **Recovery key access only** — select **Full Control** exclusively for **BitLocker Management (Recovery Key)**, leaving all other BitLocker permissions unchecked.

  ![Role permissions configured for recovery key access only.](https://www.manageengine.com/products/desktop-central/help/images/blm-rbac-2.png)

  Recovery-key-only role permissions.

**Tip:** For troubleshooting recovery key access issues and permission requirements, see [Recovery Key Troubleshooting > Cannot View Recovery Key — Permission Issues](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/kb/bitlocker-recovery-key-troubleshooting.html#cannot-view-recovery-key-permission).

## Related

- [BitLocker Policy Creation](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-policy-creation.html)
- [Recovery Key Management](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/recovery-key.html)
- [BitLocker Recovery Key Troubleshooting](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/kb/bitlocker-recovery-key-troubleshooting.html)