Retrieve Bitlocker recovery via Azure automation from Intune/Entra.

Question

This is the code.

# Connect to Azure with Managed Identity
Connect-MgGraph -Identity

# Enter serial
$ciSerial = "device serial"

$Device = Get-MgDeviceManagementManagedDevice -Filter "serialNumber eq '$ciSerial'"

$keys = Get-MgInformationProtectionBitlockerRecoveryKey -Filter "deviceId eq '$($Device.AzureADDeviceId)'"

$AzureID = $Device.AzureAdDeviceId

Write-Output $keys

The result is as followed:

Currently I'm hard coding the serial but eventually I'll have it retrieve from an external database. As you can see, I get the data location, but the Key always appears blank. Any advice would be appreciated.

Answer 1

Hello Anthony

The key is blank because Microsoft Graph only returns BitLocker key metadata by default for security. You need to call the specific recovery key endpoint with $select=key (using the key ID) and ensure your managed identity has BitlockerKey.Read.All permission with admin consent to retrieve the actual key.

Connect-MgGraph -Identity
$ciSerial = "device serial"
$Device = Get-MgDeviceManagementManagedDevice -Filter "serialNumber eq '$ciSerial'"
$keyInfo = Get-MgInformationProtectionBitlockerRecoveryKey -Filter "deviceId eq '$($Device.AzureADDeviceId)'"
# Now fetch the actual key using the ID
$recoveryKey = Invoke-MgGraphRequest -Method GET `
  -Uri "https://graph.microsoft.com/v1.0/informationProtection/bitlocker/recoveryKeys/$($keyInfo.Id)?`$select=key"
Write-Output $recoveryKey

Let me know if any further queries - feel free to reach out!