Atliso-BitLockerKeyAccessAudit
1.0.0
Lists every BitLocker recovery key that was viewed in Entra ID: who read it, when, from which
IP, for which device, and whether the key has been rotated since. A key that was read and never
rotated still unlocks the drive, so those come first.
Also flags anyone who read keys for several devices in the period.
Never reads a key itself: it only lists key IDs and dates,
IP, for which device, and whether the key has been rotated since. A key that was read and never
rotated still unlocks the drive, so those come first.
Also flags anyone who read keys for several devices in the period.
Never reads a key itself: it only lists key IDs and dates,
Lists every BitLocker recovery key that was viewed in Entra ID: who read it, when, from which
IP, for which device, and whether the key has been rotated since. A key that was read and never
rotated still unlocks the drive, so those come first.
Also flags anyone who read keys for several devices in the period.
Never reads a key itself: it only lists key IDs and dates, which doesn't create an audit event.
Exports a CSV and exits 1 when a viewed key is still valid. Changes nothing in your tenant.
https://atliso.com/blog/who-viewed-bitlocker-recovery-key-entra
Show more
IP, for which device, and whether the key has been rotated since. A key that was read and never
rotated still unlocks the drive, so those come first.
Also flags anyone who read keys for several devices in the period.
Never reads a key itself: it only lists key IDs and dates, which doesn't create an audit event.
Exports a CSV and exits 1 when a viewed key is still valid. Changes nothing in your tenant.
https://atliso.com/blog/who-viewed-bitlocker-recovery-key-entra
Installation Options
Owners
Copyright
(c) 2026 Atliso. MIT License.
Package Details
Author(s)
- Atliso
Tags
BitLocker RecoveryKey Entra Intune AuditLog Graph Audit ReadOnly
Functions
Write-Log Get-HttpStatus Invoke-Graph Get-GraphList ConvertTo-UtcDate Format-Date Get-KeyRead
Dependencies
This script has no dependencies.
Release Notes
First release.
FileList
- Atliso-BitLockerKeyAccessAudit.nuspec
- Atliso-BitLockerKeyAccessAudit.ps1
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 1.0.0 (current version) | 9 | 10/31/2026 |