How to get devices with missing bitlocker key in azure/intune

Question

eli sorow 46

Hello,

is there anyway to have the information : bitlocker key presence per device ?

the Get bitlockerRecoveryKey cmdlet does not help

Get-MgInformationProtectionBitlockerRecoveryKey give all the key but if the device has not escrow the key it is useless.

the goal is to get devices that have not the bitlocker key in azure

having all key per device will be helpfull to get device with missing key.

thank you for your help

BR

MTG 1,246 Reputation points

2023-11-23T09:30:53.6+00:00

Why not make all devices backup their key to AAD and log the success? It does not hurt with those that have already saved their key to AAD. A script one liner would do.
eli sorow 46 Reputation points

2023-11-24T07:56:10.01+00:00

it s actually the case with script / remediation in Intune. but it s not the same as list all devices without key for reporting. i didn't imagine that it will be so difficult to get this device information. get all the devices and their key since the opposite is possible with the bitlocker cmdlet.

1 answer

MTG 1,246 Reputation points

2023-11-23T09:30:53.6+00:00

Why not make all devices backup their key to AAD and log the success? It does not hurt with those that have already saved their key to AAD. A script one liner would do.
eli sorow 46 Reputation points

2023-11-24T07:56:10.01+00:00

it s actually the case with script / remediation in Intune. but it s not the same as list all devices without key for reporting. i didn't imagine that it will be so difficult to get this device information. get all the devices and their key since the opposite is possible with the bitlocker cmdlet.

Answer 1

Vasil Michev 119.6K MVP Volunteer Moderator

The cmdlet does allow filtering per device, though executing it that way will take a lot more time. Just in case, here's how to do it:

Get-MgInformationProtectionBitlockerRecoveryKey -Filter "DeviceId eq '05ab7c00-ea9d-4c1b-8dc2-ef539bf2a27b'"

I'd strongly recommend filtering the device list before passing it to the Get-MgInformationProtectionBitlockerRecoveryKey cmdlet.