BitlockerKey.Read.All

Allows the app to read BitLocker keys on behalf of the signed-in user, for their owned devices. Allows read of the recovery key.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the BitlockerKey.Read.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	57f1cf28-c0c4-4ec3-9a30-19a2eaaf2f6e	b27a61ec-b99c-4d6a-b126-c4375d08ae30
DisplayText	Read all BitLocker keys	Read BitLocker keys
Description	Allows an app to read BitLocker keys for all devices, without a signed-in user. Allows read of the recovery key.	Allows the app to read BitLocker keys on behalf of the signed-in user, for their owned devices. Allows read of the recovery key.
AdminConsentRequired	Yes	Yes

Graph Methods

• API [v1.0]
• API [beta]
• PowerShell [v1.0]
• PowerShell [beta]

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	GET /informationProtection/bitlocker/recoveryKeys
	GET /informationProtection/bitlocker/recoveryKeys/{bitlockeryRecoveryKeyId}

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

• bitlockerRecoveryKey

Graph reference: bitlockerRecoveryKey

Property	Type	Description
createdDateTime	DateTimeOffset	The date and time when the key was originally backed up to Microsoft Entra ID. Not nullable.
deviceId	String	Identifier of the device the BitLocker key is originally backed up from. Supports $filter (eq).
id	String	The unique identifier for the BitLocker key.
key	String	The BitLocker recovery key. Returned only on $select. Not nullable.
volumeType	volumeType	Indicates the type of volume the BitLocker key is associated with. The possible values are: 1 (for operatingSystemVolume), 2 (for fixedDataVolume), 3 (for removableDataVolume), and 4 (for unknownFutureValue).