FileVault Key Rotation

FileVault encrypts your macOS device's startup disk, securing your data with a unique Personal Recovery Key (PRK). If you ever forget your password, this recovery key can be used to unlock your device.

FileVault Key Rotation enhances security by periodically replacing the recovery key with a new one, especially after it has been used or at scheduled intervals.

Why Rotate the FileVault Recovery Key?

Rotating the recovery key helps:

• Reduce the risk if the existing key is compromised.

• Maintain compliance with internal or industry security policies.

• Ensure the recovery key remains current and secure.

How FileVault Key Rotation works

1. You can configure FileVault to automatically rotate the recovery key after a set period, after it has been accessed.

2. After rotation, the new key is escrowed to Scalefusion, and users can access it through the dashboard or from an administrator.

3. Regular key rotation helps to mitigate the risk of unauthorized access to your encrypted data, especially if the original key has been compromised or exposed.

Pre-requisites

1. Make sure that you have one of the following:

   1. Business 2025 subscription plan, Or

   2. The feature Filevault Rotation macOS is enabled for your account

2. macOS device has been enrolled in Scalefusion with the latest Scalefusion MDM Client (agent app for macOS), that is, version 4.29.9

3. In macOS device profile, FileVault settings should be enabled with Personal or Personal & Institutional as Recovery Key Type
   

   

4. FileVault is enabled on the device itself.

Configure FileVault Key Rotation Settings

Step 1: Access Settings in Scalefusion

1. Sign in to the Scalefusion Dashboard.

2. Go to Utilities > Global Settings > Apple Settings.

3. Locate the section FileVault Key Rotation Settings – macOS.
   Note: These settings are applicable only if FileVault is enabled on the device.

Step 2: Configure Rotation Settings

4. After configuring the options, click Save Settings.

FileVault Key Rotation on Device

Silent Rotation (No User Involvement)

Key rotation occurs silently if the following are true:

• Device is enrolled via ADE (Apple Device Enrollment).

• The Global Admin / Scalefusion-service account has a SecureToken.

When Silent Rotation Fails

If the system cannot perform silent rotation:

1. Ensure the Fallback to User Prompt for Password option is enabled on the dashboard.

2. The user will receive a prompt listing SecureToken-enabled user accounts.

3. Here:

   • Select a username.

   • Enter the password.

   • Click Proceed.

   

4. Upon successful validation, the key will rotate and sync with the Dashboard.

Viewing and Managing FileVault Keys from the Dashboard

1. From the Device Details

1. Go to Device Details > click the Gear icon > select Full Device Info.

2. Navigate to the FileVault Info tab.
   

   

Here, you can:

1. View Personal Recovery Key: Click View Key, enter your Scalefusion Dashboard password, and click Submit.
   

   

2. View FileVault Rotation History: See rotation status, timestamps, and failure reasons (if any). To view,

   1. Click on the icon next to the recovery key.
      

      

   2. This Opens a new dialog displaying FileVault key rotation history with details like:

      1. Status: Current status of FileVault key (Rotated, Failed etc.)

      2. Timestamp: The date and time at which rotation of FileVault key was taken into action

      3. Additional Info: Any additional info like the reason for failed rotation, failed key validation etc.
         

         

3. Rotate FileVault Key Manually: Use this option if you want to trigger rotation on-demand.
   

   

2. FileVault Status Report

• Navigate to the FileVault Status Report section for a summary of:

  • FileVault enablement status

  • Last key rotation

  • Validation success/failure

  • Any pending prompts or issues