📱 Recipe · Intune & Device Management
Retrieve BitLocker Recovery Keys for a User's Device via Microsoft Graph
Locate a user's Entra-joined or Intune-managed device and retrieve its BitLocker recovery key for drive unlock or recovery scenarios
Complexity
Intermediate
Impact
security + device-management + helpdesk + compliance
Context
Why This Matters
BitLocker recovery keys are required when a user is locked out of their encrypted Windows device — common triggers include TPM changes, firmware updates, forgotten PINs, boot configuration changes, or hardware repairs. As an IT admin, you need a fast, reliable path from user identity to recovery key without forcing the user to wait while you click through multiple portals.
Microsoft escrows BitLocker recovery keys to Entra ID (for Entra-joined or Hybrid-joined devices) and surfaces them through both the Intune/Entra admin portals and the informationProtection/bitlocker/recoveryKeys Microsoft Graph endpoint. This recipe walks through the full lookup chain: user → registered/managed device → recovery key(s) associated with that device.
Run this recipe whenever a helpdesk ticket asks for a BitLocker recovery key, during device reimaging workflows, or when validating that encryption keys are properly escrowed before decommissioning a laptop.
Expected Outcomes
After completing this recipe you will have:
- Identified the target user's registered and Intune-managed devices
- Mapped the device's
deviceId(Azure AD Device ID) to one or more BitLocker recovery key records - Retrieved the 48-digit numerical recovery password for a specific key ID
- An auditable record in the Entra ID audit log that a recovery key was viewed (regulatory/compliance trail)
- A repeatable script the helpdesk can use for future BitLocker unlock requests
Risks & Considerations
Before you run this:
- Reading a recovery key is audited. Every
GETon a recovery key'skeyproperty generates an audit event in Entra ID. Treat recovery keys like credentials. - Rotate the key after use. Once you share a recovery key with an end user, the key is considered compromised. Trigger a BitLocker key rotation via Intune (
rotateBitLockerKeysaction) once the device is unlocked and back online. - Verify identity first. Never read out a recovery key without confirming the requester is the device owner (callback verification, MFA prompt, manager approval — follow your IR playbook).
- Personal devices are out of scope. Only Entra-joined, Hybrid-joined, or Intune-enrolled devices escrow keys to your tenant. BYOD / workplace-joined devices do not.
- High-privilege permissions.
BitlockerKey.Read.Allgrants tenant-wide access to every recovery key — limit which admins hold roles that can consent to or exercise this scope (Cloud Device Administrator, Intune Administrator, Helpdesk Administrator with BitLocker recovery permission). - Do not store recovery keys outside the tenant. Avoid pasting them into ticketing systems, chat, or email. Read once, use once, rotate.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| User.Read.All | Resolve the UPN to the user's object ID and read basic directory information. |
| Device.Read.All | List Entra ID registered devices owned by the user and retrieve the device's deviceId (Azure AD Device ID). |
| DeviceManagementManagedDevices.Read.All | Query Intune-managed devices filtered by userPrincipalName to correlate the managed device with its Azure AD Device ID. |
| BitlockerKey.ReadBasic.All | List BitLocker recovery key metadata (id, deviceId, createdDateTime, volumeType) without exposing the recovery password. |
| BitlockerKey.Read.All | Retrieve the actual 48-digit recovery password via $select=key on a specific recovery key resource. |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
For End Users
How an employee would ask Dex for help
Retrieve a BitLocker recovery key via the admin portals
Locate the user's device in Entra ID
Sign in to the . In the filter bar, search for the owner's display name or UPN. Note the device Name and Object ID.
Alternative: Locate the device in Intune
Go to . Filter on Primary user UPN. Open the device and copy its Azure AD Device ID.
Open the device's recovery keys blade
From the device's overview page in Entra or Intune, select (Intune) or scroll to the BitLocker keys section (Entra). You will see one row per encrypted volume, each with a Key ID and Backed up timestamp.
Show the recovery key
Click Show recovery key next to the relevant volume. Entra will display the 48-digit numerical password. This action is logged to the Entra audit log under Read BitLocker key.
Verify the key ID matches what the user sees
On the locked device's recovery screen, Windows displays the first 8 characters of the Key ID. Match those against the Key ID in the portal before reading out the recovery password.
Rotate the key post-recovery
Once the device is unlocked, go back to the Intune device blade and select . This invalidates the disclosed key and escrows a fresh one.
Retrieve a BitLocker recovery key via Microsoft Graph
The flow is three calls: resolve the user, find their device(s), then look up recovery keys filtered by deviceId.
1. Resolve the user
GET https://graph.microsoft.com/v1.0/users/{upn}?$select=id,displayName,userPrincipalNameResponse:
{
"id": "a1b2c3d4-...",
"displayName": "Jane Doe",
"userPrincipalName": "jane.doe@contoso.com"
}2. List the user's devices
Entra-registered devices:
GET https://graph.microsoft.com/v1.0/users/{upn}/registeredDevices?$select=id,displayName,deviceId,operatingSystemOr, Intune-managed devices (preferred when you need the primary user):
GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?$filter=userPrincipalName eq '{upn}'&$select=id,deviceName,azureADDeviceId,operatingSystemCapture the deviceId (Entra) or azureADDeviceId (Intune) — both are the same GUID and are what the BitLocker endpoint keys off of.
3. List recovery keys for that device
GET https://graph.microsoft.com/v1.0/informationProtection/bitlocker/recoveryKeys?$filter=deviceId eq '{azureADDeviceId}'Response (metadata only — key is not returned in a list):
{
"value": [
{
"id": "b7c9...",
"createdDateTime": "2024-03-12T14:02:11Z",
"volumeType": "operatingSystemVolume",
"deviceId": "d3e4..."
}
]
}4. Read the recovery password
You must request $select=key explicitly and target the specific key ID. This is the audited call.
GET https://graph.microsoft.com/v1.0/informationProtection/bitlocker/recoveryKeys/{keyId}?$select=keyResponse:
{
"id": "b7c9...",
"key": "123456-234567-345678-456789-567890-678901-789012-890123"
}5. (Recommended) Rotate the key after use
POST https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{managedDeviceId}/rotateBitLockerKeysReturns 204 No Content. The device must be online for the rotation to complete.
PowerShell workflow using Microsoft.Graph
Install and connect:
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "User.Read.All","Device.Read.All","DeviceManagementManagedDevices.Read.All","BitlockerKey.Read.All"Key cmdlets:
Get-MgUser -UserId $upn— resolve the userGet-MgUserRegisteredDevice -UserId $userId— list Entra-registered devicesGet-MgDeviceManagementManagedDevice -Filter "userPrincipalName eq '$upn'"— list Intune devicesGet-MgInformationProtectionBitlockerRecoveryKey -Filter "deviceId eq '$azureAdDeviceId'"— enumerate recovery keysGet-MgInformationProtectionBitlockerRecoveryKey -BitlockerRecoveryKeyId $keyId -Property key— retrieve the 48-digit password (audited)
The downloadable script below combines these into a single end-to-end lookup. It accepts a UPN, optionally a volume type, prints all recovery keys found for that user's devices, and (with -Reveal) fetches the actual passwords. It includes -RotateAfterReveal to immediately trigger a key rotation on the associated Intune-managed device once the key is disclosed.
Permission gotcha: if calls return 403 Insufficient privileges, reconnect with Connect-MgGraph and confirm the BitlockerKey.Read.All scope appears in (Get-MgContext).Scopes. Admin consent for this scope is required at the tenant level.
Next steps