> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Report FileVault keys escrowed to iCloud

> Detect Mac user accounts with FileVault recovery keys stored in iCloud using the Blueprint parameter. Get alerts for unescrowed recovery keys.

<Callout icon="apple" color="#B84A7A" iconType="regular">This guide applies to Mac computers</Callout>

### About the Report FileVault iCloud Recovery Keys Parameter

This parameter monitors and reports when user accounts have FileVault Recovery Keys escrowed to iCloud, which is not recommended for enterprise-owned Mac devices.

### How It Works

The parameter raises an alert if a Recovery Key is stored in iCloud, providing a reminder to work with the user to remove the recovery key from their iCloud account for better security.

macOS allows users to store Recovery Keys with their iCloud account. This is not recommended for enterprise-owned Mac devices, as it's possible that an unknown party can retrieve keys. This parameter raises an alert if a Recovery Key is stored in iCloud, providing a reminder to work with the user and follow the steps below to remove the recovery key from their iCloud account.

### Remove the FileVault library item

Remove the FileVault library item assignment from the Mac with the following steps:

<Steps>
  <Step title="Exclude from FileVault Assignment">
    Use a rule in your [Assignment Map](/en/endpoint/blueprints/assignment-maps/using-conditional-logic-in-blueprints) to exclude the Mac from getting the FileVault Library Item installed.
  </Step>

  <Step title="Turn Off FileVault">
    Once the FileVault profile has been removed from the Mac, launch System Settings and [turn off FileVault encryption](https://support.apple.com/guide/mac-help/turn-off-filevault-encryption-on-mac-mchlp2560/mac).
  </Step>

  <Step title="Remove Security Preferences File">
    If present, remove the following file locally within the home directory of the associated iCloud user:

    ```bash theme={null}
    ~/Library/Preferences/com.apple.preference.security.plist
    ```
  </Step>
</Steps>

### Reassign the FileVault library item

<Note>
  Depending on your [FileVault enforcement settings](/en/endpoint/library/deployment-guides/apple/configure-filevault), a forced restart of the Mac or reminder that the end user must restart to enforce FileVault encryption may be triggered when the FileVault library item is reassigned.
</Note>

<Steps>
  <Step title="Re-enable FileVault Assignment">
    Change the rule in your Assignment Map to include the Mac again, which will trigger a reinstall of the FileVault profile.
  </Step>

  <Step title="Verify FileVault Status">
    As enforced by your library item, FileVault should now be turned on, and the iCloud account may no longer be used to unlock the disk.
  </Step>
</Steps>