How to find missing BitLocker recovery keys in Intune

Before you start

Use an account with 1 of the roles Microsoft lists for reading the keys: Cloud Device Administrator, Helpdesk Administrator, Intune Administrator, Security Administrator, Security Reader or Global Reader. The PowerShell example requests BitlockerKey.ReadBasic.All, which lists keys without their values, and Device.Read.All; your organisation may require administrator consent.

Keys are read as Entra ID holds them now. Showing a key's value writes an audit log entry, and none of the steps here do. The examples read and export; they change nothing and reveal no key.

Option 1

Find missing BitLocker recovery keys with PowerShell

Install the modules once, then connect, read the devices and the keys and keep the devices with none.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Identity.DirectoryManagement,
    Microsoft.Graph.Identity.SignIns -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'BitlockerKey.ReadBasic.All', 'Device.Read.All' -NoWelcome
try {
    $properties = 'deviceId', 'displayName', 'operatingSystem', 'trustType', 'accountEnabled',
        'approximateLastSignInDateTime'
    # Entra joined (AzureAd) and hybrid joined (ServerAd), not registered personal devices.
    $filter = "trustType in ('AzureAd', 'ServerAd')"
    $devices = @(Get-MgDevice -All -Filter $filter -Property $properties |
        Where-Object { $_.OperatingSystem -like 'Windows*' })
    $withKey = @{}
    foreach ($key in Get-MgInformationProtectionBitlockerRecoveryKey -All) {
        $withKey[$key.DeviceId] = $true
    }
    $columns = 'DisplayName', 'DeviceId', 'TrustType', 'AccountEnabled',
        'ApproximateLastSignInDateTime'
    $report = @($devices | Where-Object { -not $withKey.ContainsKey($_.DeviceId) } |
        Sort-Object DisplayName | Select-Object $columns)
    if ($report.Count -eq 0) {
        Write-Output "All $($devices.Count) Windows devices have a recovery key in Entra ID."
    } else {
        $report | Export-Csv -Path './missing-bitlocker-keys.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) of $($devices.Count) Windows devices have no recovery key."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The CSV has 1 row for each device with no key, with whether it's enabled and roughly when it last signed in, which helps you tell a device in use from one that's gone. A key belongs to the device it was most recently backed up from, matched by the device ID. To keep disabled devices out, add -and $_.AccountEnabled after the operating system test in the first Where-Object.

Check a single device

Reconnect with Connect-MgGraph, then list 1 device's keys by its device ID. The export above disconnects when it finishes.

# Run while connected to Microsoft Graph. Replace the example device ID.
$filter = "deviceId eq '1ab40ab2-32a8-4b00-b6b5-ba724e407de9'"
Get-MgInformationProtectionBitlockerRecoveryKey -Filter $filter |
    Select-Object Id, VolumeType, CreatedDateTime

No output means the device has no key in Entra ID. CreatedDateTime is when each key was backed up.

Option 2

Check recovery keys in the admin centre

1. Sign in to the Microsoft Intune admin centre for the correct tenant.
2. Go to Devices > All devices and select a Windows device.
3. Under Monitor, select Recovery keys. A device with none shows No BitLocker key found for this device. Leave Show Recovery Key alone: it reveals the key and writes an audit log entry.
4. For devices Intune encrypts, go to Devices > Manage devices > Configuration, select the Monitor tab, then Device encryption status. A device's details can say its recovery key backup failed.

This suits checking a device in front of you. Every device means opening each in turn, so for a whole tenant use PowerShell or a report.

Common questions

Does no key mean the device isn't encrypted?

Not always. It can be unencrypted, or encrypted without its key reaching Entra ID. To see which devices Intune doesn't report as encrypted, see how to find unencrypted Windows devices in Microsoft Intune.

Why didn't an encrypted device back up its key?

Microsoft says silent BitLocker encryption backs up the recovery key to Entra ID as it encrypts, which needs the device to be Entra joined. Check that it is, and look for a policy conflict that stops the backup.

Is there a limit to the keys a device can hold?

Yes. Microsoft says Entra ID holds at most 200 BitLocker recovery keys for each device, and a device at the limit fails silent encryption because it can't back up a new key first.