Devices that lack a bitlocker recovery key in AzureAD

With Intune’s new Bitlocker Encryption Report administrators have an effective way of seeing which of their devices have been encrypted.

But if we want to know if we can actually recover the bitlocker key of a device, we need to know if it was ever uploaded to AzureAD.

Network or local device issues can sometimes prevent the recovery key from reaching AzureAD, resulting in lost data if the device’s disk needs to be recovered for any reason. To hunt down devices that have not escrowed their recovery key to AzureAD, you can use my report function (in PowerShell as always):

GitLab source download link

Notify of

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Most Voted
Newest Oldest
Inline Feedbacks
View all comments
Yeswanth Kumar
Yeswanth Kumar
1 year ago

Using Switch -showBitlockerKeysInReport does not show the key in the report. Any advise please?

3 months ago

This has to be run as Global Admin and I added these 3 codes to this function and seems to be working for me

Install-Module -Name importexcel -Force -Verbose -ErrorAction SilentlyContinue
  Install-Module -Name AzureRM.profile -RequiredVersion 5.8.2 -Verbose -Force -AllowClobber -ErrorAction SilentlyContinue
  Install-Module azuread -Verbose -Force -ErrorAction SilentlyContinue

Quintin Schnuir
Quintin Schnuir
2 months ago

When i run the script, the Microsoft page opens for me to authenticate,
after entering my username,password and code Microsoft then says my account is blocked.
I am admin and running the script as admin

Any suggestions on how to get this to work for me please?


6 months ago

Hello, it is throwing me the following error, if someone knows the solution I will appreciate it:
Invoke-RestMethod : {“ClassName”:”Microsoft.Portal.Framework.Exceptions.ClientException”,”Message”:”Graph call failed with httpCode=Forbidden, 
errorCode=Authorization_RequestDenied, errorMessage=Insufficient privileges to complete the operation., reason=Forbidden, correlationId = 
780ee56c-6eb3-4649-aa05-d488e8c89f57, response = {\”odata.error\”:{\”code\”:\”Authorization_RequestDenied\”,\”message\”:{\”lang\”:\”en\”,\”value\”:\”Insufficient 
privileges to complete the operation.\”},\”requestId\”:\”4cb80364-9d49-447e-8584-50fe43c5fe40\”,\”date\”:\”2022-10-31T21:21:16\”}}”,”Data”:{},”HResult”:-2146233088,”X
t privileges to complete the operation.”},”operationResults”:null,”timeStampUtc”:”2022-10-31T21:21:16.2458403Z”,”clientRequestId”:”780ee56c-6eb3-4649-aa05-d488e8c89f5


[…] Devices that lack a bitlocker recovery key in AzureAD | Liebensraum […]

2 years ago

It´s not working for me. I tried to convert AzureRM to AZ cmdlets with MS migration tool. But no luck. This script must be run as a GlobalAdmin? ( I´m only an IntuneAdmin )

Line |
 56 | … shToken = @($context.TokenCache.ReadItems() | where {$_.tenantId -eq …
   |        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   | You cannot call a method on a null-valued expression.

Line |
 58 | … $apiToken = Invoke-RestMethod “$tenantId/oa …
   |        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   | {“error”:”invalid_request”,”error_description”:”AADSTS900144: The request body must contain the following parameter: ‘refresh_token’.\r\nTrace ID: ff042c93-a0a2-42b1-bb72-69a692f41500\r\nCorrelation ID:
   | df000497-edd4-4348-b10d-ad7f7021ce39\r\nTimestamp: 2020-11-18 12:01:00Z”,”error_codes”:[900144],”timestamp”:”2020-11-18
   | 12:01:00Z”,”trace_id”:”ff042c93-a0a2-42b1-bb72-69a692f41500″,”correlation_id”:”df000497-edd4-4348-b10d-ad7f7021ce39″,”error_uri”:”″}