So i am looking for any solution to assist with backing up Bitlocker recovery keys to Azure AD

History: We had MBAM which was not storing keys in AD for some of our USB drives, we have opted to move to Intune for the USB key bitlocker and found that the keys are not uploading to AzureAD, so we can not see them in Devices > Device > Rccovery Keys

This creates a bit of an issue where if we have users who have lost their password we are unable to recover keys, i am hoping to do one of the following methods

1. Create a scheduled task on all endpoints that will run when the bdeunlock.exe application finishes (this application shows in task manager when the USB key that is locked is attempted to be opened)
2. Create a remediation script that will check if the USB recovery key is already uploaded to AzureAD, if it is exit 0, if its not exit 1, however i find some difficulties in this as we never know when a user will be attempting to connect their USB device and it needs to be unlocked for the BackupToAAD-BitLockerKeyProtector powershell command to run

i am interested to see what other methods people have been able to achieve

1. Create a scheduled task

• When i attempt to create a scheduled task it asks me for an event ID and a event log, i am unable to detect this information for the bdeunlock.exe

2. Create a remediation script

• The remediation script i created checks if there is a USB drive connected and the protection status is on, if not the script will return that bitlocker is not enabled (this method would work if we had all USB devices connected and unlocked but without knowing when this would happen the script would be always trying to run?