Hide "View Bitlocker Keys" Option in My Account page

Kedar Tamboli 166

Hello All,

We are using Intune Encryption on Windows 10 systems. As I understood that enrolled user can see the recovery keys in My Account page (https://myaccount.microsoft.com/device-list).

There can be chances of data loss from legitimate user if user has access to recovery keys. Please correct if my understanding is wrong. How can we address this security point. Can we hide "View Bitlocker Keys" Option from My Account page so that in case of recovery User will always connect with internal Azure AD team for recovery keys?

Also do let us know if audit log captures in Intune portal if User access / read the BitLocker keys.

Please share your views on it.

Thanks and regards,
Kedar

Oleg Melnychuk 26 Reputation points

2023-03-14T16:38:36.0333333+00:00

Please use this guide: https://www.anoopcnair.com/block-hide-bitlocker-recovery-key-users-graph/As I understand it's possible using Intune Graph API

1 answer

Jason Sandys 31,196 Reputation points Microsoft Employee

2021-06-21T16:32:26.47+00:00

No, you cannot hide the key today. We are working on this functionality though. Same with additional auditing.
Please sign in to rate this answer.

5 people found this answer helpful.
JamesTran-MSFT 36,541 Reputation points Microsoft Employee

2021-06-21T21:56:02.933+00:00

@Kedar Tamboli
Thank you for your post! Please let us know if you have any other questions.

Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Lu Dai-MSFT 28,371 Reputation points

2021-07-09T08:08:36.313+00:00

@Jason Sandys This is really exciting information about this feature. Looking forward to the new release! : )

Paul Lo 6 Reputation points

2022-01-25T09:18:42.293+00:00

lots of my customer are asking this feature as well.
Cross finger~~~ @Jason Sandys

Jason Sandys 31,196 Reputation points Microsoft Employee

2022-01-25T15:55:16.263+00:00

Still in the "working on" phase but progressing and getting closer to be being released (although when or if it is ever released is not up to me so no commitments).

Primo Tseng 6 Reputation points

2022-01-26T02:56:45.2+00:00

we need this feature, if IT can't manage the key that means user can execute by self.

Hanbo Shen 1 Reputation point

2022-02-08T06:42:06.35+00:00

It would be awesome if we could get this feature soon enough!

ComentAnonim443 6 Reputation points

2022-04-22T07:54:41.117+00:00

Do we have any news on this issue? This functionality, which is active right now, seems to be a security issue and the IT team should have full control with the AAD permissions, so users should not be able to access this information.

The problem occurs because users in AAD have default permissions to read the bitlocker recovery keys of their owned devices.

Owned devices
Users can perform the following actions on owned devices:

Action Description
microsoft.directory/devices/bitLockerRecoveryKeys/read Read the devices.bitLockerRecoveryKeys property in Azure AD.
microsoft.directory/devices/disable Disable devices in Azure AD.

https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions?context=/azure/active-directory/roles/context/ugr-context

Thank you very much,
Best regards.

ComentAnonim443 6 Reputation points

2022-04-22T07:59:04.207+00:00

Do we have any news on this issue? This functionality, which is active right now, seems to be a security issue and the IT team should have full control with the AAD permissions, so users should not be able to access this information.

The problem occurs because users in AAD have default permissions to read the bitlocker recovery keys of their owned devices.

Owned devices
Users can perform the following actions on owned devices:

Action Description
microsoft.directory/devices/bitLockerRecoveryKeys/read Read the devices.bitLockerRecoveryKeys property in Azure AD.
microsoft.directory/devices/disable Disable devices in Azure AD.

https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions?context=/azure/active-directory/roles/context/ugr-context

Thank you very much,
Best regards.

Abdelrahman Elarar 1 Reputation point

2022-06-06T09:05:46.537+00:00

Hello @Jason Sandys

Is there any roadmap for this feature? when will apply and what phase/process Microsoft on ?

Thanks

Ramesh Velusamy 1 Reputation point

2022-07-20T18:47:12.327+00:00

Hello Jason - Is there any good news on this feature to hide bitlocker key view under devices - myaccount page ?

Regards,
Ramesh

Jason Sandys 31,196 Reputation points Microsoft Employee

2022-07-20T19:23:19.13+00:00

Good news? Yes, it's coming. There's nothing additional to disclose publicly at this time though.

Ramesh Velusamy 1 Reputation point

2022-07-20T21:58:29.027+00:00

Thank you Jason. Please let us know if any progress on the availability

Madi 1 Reputation point

2022-11-09T19:25:37.28+00:00

Looks like it is in preview, now!

Jason Sandys 31,196 Reputation points Microsoft Employee

2022-11-09T19:29:57.4+00:00

Correct. I think this went public preview in July.
Sign in to comment

Share via

Hide "View Bitlocker Keys" Option in My Account page

1 answer