Windows LAPS & BitLocker Escrow Gaps

The question it answers: Which Windows devices have no BitLocker recovery key or Windows LAPS password backed up in Entra ID?

Two secrets must be in Entra ID before something goes wrong: the BitLocker recovery key (or the device’s data is gone when it locks out) and the Windows LAPS local-administrator password (or support cannot log in when the device loses trust). Windows devices missing either are listed first.

Note

Use the ReadBasic permissions only - DeviceLocalCredential.Read.All and BitLockerKey.Read.All would expose the secrets themselves. If one source is not granted, its column shows n/a instead of false findings.

At a glance

Where in the app	Intune › Endpoint Security & Readiness › LAPS & BitLocker Escrow
Workload	Intune
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Intune; Windows LAPS enabled in Entra ID device settings.
Report id (API and MCP)	intune.endpoint.recovery-escrow-gaps

Columns

Column	Key	Type
Device	DeviceName	Link
User	UserPrincipalName	Text
Finding	Finding	Status
LAPS	Category	Text
BitLocker keys	Value	Text
Ownership	OwnerType	Text
Last sync	LastSyncDateTime	Date

Filters

Filter	Key (API)	On when the page opens
Only devices with a gap	gaps	Yes

What it needs

Licence: Microsoft Intune; Windows LAPS enabled in Entra ID device settings.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
DeviceLocalCredential.ReadBasic.All	Microsoft Graph	Read device local credential properties
BitlockerKey.ReadBasic.All	Microsoft Graph	Read all BitLocker keys basic information
DeviceManagementManagedDevices.Read.All	Microsoft Graph	Read Microsoft Intune devices

Data sources it reads

• GET /v1.0/directory/deviceLocalCredentials (no credentials)
• GET /v1.0/informationProtection/bitlocker/recoveryKeys (no key material)
• GET /beta/deviceManagement/managedDevices

Through the API and MCP

GET /ir-api/v1/reports/intune.endpoint.recovery-escrow-gaps?size=100
GET /ir-api/v1/reports/intune.endpoint.recovery-escrow-gaps?filter=gaps

An AI assistant reads it with the MCP tool get_report and the id intune.endpoint.recovery-escrow-gaps. The client needs the Read grant for Intune. See Using the API.