Devices with uploaded Bitlocker Keys

The question it answers: Which devices have a BitLocker recovery key in Entra ID, of which volume type and since when?

Because we use basic permissions we don’t have access to the key itself, only to the metadata. This, this report does not show any keys.

Note

Lists every device with the volume type and upload date of its newest recovery key; a device without a key has those columns empty. If the devices or keys cannot be read, the report shows an error.

At a glance

Where in the app	Entra ID › Devices › BitLocker Keys per Device
Workload	Entra ID
Kind	Table
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed).
Licence	No extra licence needed.
Report id (API and MCP)	entra.devices.bitlocker

Columns

Column	Key	Type
Display Name	DisplayName	Link
Registered Owners	RegisteredOwners	Text
Object Id	ObjectId	Text
Bitlocker volume type	VolumeTypeRaw	Text
Date Uploaded	CreatedDateTime	DateTime

What it needs

Licence: No extra licence needed.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
BitlockerKey.ReadBasic.All	Microsoft Graph	Read all BitLocker keys basic information
Device.Read.All	Microsoft Graph	Read all devices
User.Read.All	Microsoft Graph	Read all users’ full profiles

Data sources it reads

• GET /v1.0/informationProtection/bitlocker/recoveryKeys?$select=id,deviceId,createdDateTime,volumeType
• the cached device list (All Devices: GET /v1.0/devices, owners and users expanded)

Through the API and MCP

GET /ir-api/v1/reports/entra.devices.bitlocker?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.devices.bitlocker. The client needs the Read grant for Entra ID. See Using the API.