Atliso-BitLockerKeyAccessAudit

Lists every BitLocker recovery key that was viewed in Entra ID: who read it, when, from which IP, for which device, and whether the key has been rotated since. A key that was read and never rotated still unlocks the drive, so those come first. Also flags anyone who read keys for several devices in the period. Never reads a key itself: it only lists... More info