BitlockerKey.ReadBasic.All

Allows the app to read basic BitLocker key properties on behalf of the signed-in user, for their owned devices. Does not allow read of the recovery key itself.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the BitlockerKey.ReadBasic.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	f690d423-6b29-4d04-98c6-694c42282419	5a107bfc-4f00-4e1a-b67e-66451267bc68
DisplayText	Read all BitLocker keys basic information	Read BitLocker keys basic information
Description	Allows an app to read basic BitLocker key properties for all devices, without a signed-in user. Does not allow read of the recovery key.	Allows the app to read basic BitLocker key properties on behalf of the signed-in user, for their owned devices. Does not allow read of the recovery key itself.
AdminConsentRequired	Yes	Yes

Graph Methods

• API [v1.0]
• API [beta]
• PowerShell [v1.0]
• PowerShell [beta]

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	GET /informationProtection/bitlocker/recoveryKeys
	GET /informationProtection/bitlocker/recoveryKeys/{bitlockeryRecoveryKeyId}

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

• bitlockerRecoveryKey

Graph reference: bitlockerRecoveryKey

Property	Type	Description
createdDateTime	DateTimeOffset	The date and time when the key was originally backed up to Microsoft Entra ID. Not nullable.
deviceId	String	Identifier of the device the BitLocker key is originally backed up from. Supports $filter (eq).
id	String	The unique identifier for the BitLocker key.
key	String	The BitLocker recovery key. Returned only on $select. Not nullable.
volumeType	volumeType	Indicates the type of volume the BitLocker key is associated with. The possible values are: 1 (for operatingSystemVolume), 2 (for fixedDataVolume), 3 (for removableDataVolume), and 4 (for unknownFutureValue).