BitLocker Key Access Audit
Read-only PowerShell script that lists who viewed each BitLocker recovery key in Entra ID, for which device, and whether the key was rotated afterwards.
What it does
- Reads every Read BitLocker key event in the Entra audit log for the last 1 to 30 days, through Microsoft Graph with your own account
- Matches each read to the device name and says who read it: the device owner, an admin or an app, with the IP address
- Checks whether the device backed up a newer key after the read. Keys that were read and never rotated come first
- Lists failed attempts by accounts without the right role
- Flags anyone who read keys for three or more devices in the period
- Exports a CSV with a next step per read and exits 1 when a viewed key is still valid
- Read-only, and never reads a key itself, so running it adds nothing to the audit log
Configuration
You edit one block:
PowerShell
Preview snippet. The full, tested script lives in the vault.
# ===== CONFIG =====
$OutputPath = Join-Path $env:USERPROFILE 'Desktop\Atliso-BitLockerKeyReads.csv'
$BulkThreshold = 3 # flag anyone who read keys for this many devices or more in the period
$LogPath = Join-Path $env:LOCALAPPDATA 'Atliso\BitLockerKeyAccessAudit.log'
# ==================Run it
It runs on your own workstation, not on devices, with Windows PowerShell 5.1 or PowerShell 7:
PowerShell
Preview snippet. The full, tested script lives in the vault.
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
Install-Script Atliso-BitLockerKeyAccessAudit -Scope CurrentUser # from the PowerShell Gallery
Atliso-BitLockerKeyAccessAudit.ps1
# Entra ID Free keeps 7 days of audit logs
Atliso-BitLockerKeyAccessAudit.ps1 -Days 7
# MSPs: run once per customer tenant
Atliso-BitLockerKeyAccessAudit.ps1 -TenantId contoso.onmicrosoft.comFull walkthrough, including who can read keys and why viewing one doesn't rotate it: Who viewed a BitLocker recovery key? Check the Entra log
Get BitLocker Key Access Audit
We'll send the script, and updates when Microsoft changes how BitLocker keys are logged. No spam.