via Group Policy or Intune:

quarterly on a non-production device.

When a Windows device is or Hybrid Entra ID joined , and BitLocker is enabled (either manually or via policy), the recovery password and key package are uploaded to the device’s object in Entra ID.