How to Configure FileVault and Institutional Recovery Keys in macOS Sequoia

Losing a corporate laptop or having a personal workstation stolen exposes unencrypted hard drives to offline data extraction through external recovery tools. On macOS Sequoia, FileVault provides full-disk encryption (XTS-AES-128 with a 256-bit key) tied directly to Apple Silicon hardware Secure Enclaves. In addition to personal user passcodes, organizations and power users can configure Institutional Recovery Keys (IRK) and Personal Recovery Keys (PRK) to guarantee emergency decryption without risking unauthorized lockout.

Understanding FileVault Cryptographic Architecture

On modern Apple Silicon Macs (M1 through M4 series), data on the internal solid-state drive is always encrypted at the hardware level. However, without FileVault enabled, the cryptographic keys are protected only by the Secure Enclave and can be accessed automatically during standard boot sequence. Enabling FileVault enforces pre-boot authentication:

• Pre-Boot Volume Authentication: The APFS Data volume cannot be mounted until an authorized account enters their password or presents a valid cryptographic recovery key.
• Personal Recovery Key (PRK): A dynamically generated 24-character alphanumeric key unique to the individual machine.
• Institutional Recovery Key (IRK): A corporate public-key certificate used by Mobile Device Management (MDM) solutions to allow enterprise IT administrators to decrypt any managed machine in their fleet.

Enabling FileVault via System Settings

To enable FileVault on a standalone Mac:

1. Click the Apple menu () and select System Settings.
2. Navigate to Privacy & Security in the sidebar.
3. Scroll down to the FileVault section.
4. Click Turn On… next to FileVault (administrative authorization required).
5. Choose your preferred recovery method:
   • iCloud Account Recovery: Links recovery to your Apple Account credentials (ideal for individual home users).
   • Create a Recovery Key: Generates a random alphanumeric key that you must record and store in a secure offline location (recommended for advanced privacy).
6. Click Continue. FileVault begins initial encryption in the background, allowing you to continue using your Mac normally while NAND storage blocks are encrypted.

Managing and Auditing FileVault via the fdesetup CLI

System administrators can query FileVault status and manage recovery mechanisms directly in Terminal using fdesetup:

Inspect active FileVault status and encryption progress:

fdesetup status

The command returns “FileVault is On.” or reports the active encryption percentage.

List all user accounts authorized to unlock the encrypted volume:

fdesetup list

Review the list of usernames and associated cryptographic GUIDs authorized for pre-boot unlock.

Generating an Institutional Recovery Key (IRK) Keychain

For organizations deploying enterprise encryption keys across multiple Macs without relying on individual user cloud accounts:

1. Generate a master certificate authority and institutional recovery certificate using OpenSSL or macOS Keychain Access.
2. Package the public certificate into a master keychain named FileVaultMaster.keychain.
3. Deploy the master keychain to /Library/Keychains/FileVaultMaster.keychain via your MDM platform (such as Jamf Pro, Kandji, or Microsoft Intune).
4. When FileVault is enabled via MDM configuration profiles, macOS automatically encrypts the disk master unlock key using the institutional public certificate, allowing IT helpdesks to recover locked drives using the corresponding private key.

Emergency Decryption Using a Recovery Key

If an employee forgets their account password or leaves an organization:

1. Power on the Mac and wait for the pre-boot login screen to render.
2. Click the Question Mark (?) icon inside the password field or enter an incorrect password three times.
3. Click Restart and show password reset options.
4. Select Enter Recovery Key and input the 24-character personal recovery key or enter administrative institutional recovery credentials.
5. The APFS Data volume mounts immediately, permitting password resets or administrative data migration.