FileVault recovery keys after MDM re-enrollment

When a Mac re-enrolls in Oneleet MDM, Oneleet requests fresh FileVault key escrow when its effective device policy enables FileVault. Re-enrollment alone doesn’t establish whether the disk was erased or its recovery key changed.

Oneleet retains the previously saved encrypted key while waiting for fresh escrow. During this period, the Devices page doesn’t show that key as current. The Encryption key field becomes available after Oneleet receives and stores a recovery key from the device.

If the field remains unavailable, contact Oneleet support to investigate enrollment and escrow activity. An encrypted device can still be waiting for key escrow; FileVault being enabled doesn’t by itself confirm that Oneleet has received its current key.