You need to deploy a configuration profile to your machines with a security payload with the “Enable escrow personal recovery key” option enabled on High sierra and above :)

if you only want to deploy the escrow profile, which is a good idea then follow this link

thank you so much for the information.