FileVault enabled but recovery key never escrowed

Scenario

macOS encryption is active, but the institutional or personal recovery key never appeared in the management system.

Recommended Resolution Path

1. Confirm the device was enrolled and managed before FileVault activation.
2. Review the MDM escrow payload and whether the user deferred or bypassed required prompts.
3. Rotate the key if needed only after validating the management channel is healthy.
4. Treat missing escrow as a recoverability issue, not a paperwork miss.

Technician Notes

Document what changed, what confirmed the fix, and whether the issue points to a broader standards gap worth addressing for the client.