Devices that lack a bitlocker recovery key in AzureAD

With Intune’s new Bitlocker Encryption Report administrators have an effective way of seeing which of their devices have been encrypted.

But if we want to know if we can actually recover the bitlocker key of a device, we need to know if it was ever uploaded to AzureAD.

Network or local device issues can sometimes prevent the recovery key from reaching AzureAD, resulting in lost data if the device’s disk needs to be recovered for any reason. To hunt down devices that have not escrowed their recovery key to AzureAD, you can use my report function (in PowerShell as always):

GitLab source download link

Notify of

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Most Voted
Newest Oldest
Inline Feedbacks
View all comments
Yeswanth Kumar
Yeswanth Kumar
10 months ago

Using Switch -showBitlockerKeysInReport does not show the key in the report. Any advise please?


[…] Devices that lack a bitlocker recovery key in AzureAD | Liebensraum […]

1 year ago

It´s not working for me. I tried to convert AzureRM to AZ cmdlets with MS migration tool. But no luck. This script must be run as a GlobalAdmin? ( I´m only an IntuneAdmin )

Line |
 56 | … shToken = @($context.TokenCache.ReadItems() | where {$_.tenantId -eq …
   |        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   | You cannot call a method on a null-valued expression.

Line |
 58 | … $apiToken = Invoke-RestMethod “$tenantId/oa …
   |        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   | {“error”:”invalid_request”,”error_description”:”AADSTS900144: The request body must contain the following parameter: ‘refresh_token’.\r\nTrace ID: ff042c93-a0a2-42b1-bb72-69a692f41500\r\nCorrelation ID:
   | df000497-edd4-4348-b10d-ad7f7021ce39\r\nTimestamp: 2020-11-18 12:01:00Z”,”error_codes”:[900144],”timestamp”:”2020-11-18
   | 12:01:00Z”,”trace_id”:”ff042c93-a0a2-42b1-bb72-69a692f41500″,”correlation_id”:”df000497-edd4-4348-b10d-ad7f7021ce39″,”error_uri”:”″}