Prevent users from reading the BitLocker recovery keys of their own devices

Description

The device setting Restrict users from recovering the BitLocker key(s) for their owned devices is set to Yes. Only roles with the BitLocker read permission (Cloud Device Administrator, Helpdesk Administrator, Intune Administrator, Security Administrator, Security Reader) can display recovery keys, and every display is logged.

Rationale

The BitLocker recovery key bypasses the TPM and PIN protectors. If a device owner can read it in self-service, an attacker who phishes the user's session, or a user who wants to bypass device controls (for example to boot another OS or remove the TPM binding), gets it without any human check. Going through the helpdesk adds identity verification and a trace of who asked for which key.

Impact

Users who hit the BitLocker recovery screen can no longer get their key from the My Account or Company Portal pages and must call the helpdesk. Plan the helpdesk procedure (identity check, key retrieval from Entra ID or Intune) before enabling the setting, especially for travelling users.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Devices > Device settings.
3. Check that Restrict users from recovering the BitLocker key(s) for their owned devices is Yes.
4. Alternative, read only: Invoke-MgGraphRequest -Method GET -Uri https://graph.microsoft.com/v1.0/policies/authorizationPolicy (scope Policy.Read.All) and read defaultUserRolePermissions.allowedToReadBitlockerKeysForOwnedDevice.
5. Fail if the setting is No (allowedToReadBitlockerKeysForOwnedDevice is true).

Remediation

1. Document the helpdesk procedure for BitLocker recovery.
2. Browse to Entra ID > Devices > Device settings. Role: Privileged Role Administrator.
3. Set Restrict users from recovering the BitLocker key(s) for their owned devices to Yes and save.
4. Graph equivalent: PATCH https://graph.microsoft.com/v1.0/policies/authorizationPolicy with body {"defaultUserRolePermissions": {"allowedToReadBitlockerKeysForOwnedDevice": false}}.

Rollback

Set the setting back to No.

References

• Manage devices in Microsoft Entra ID - Configure device settings Microsoft, vendor-doc, accessed 2026-10-24
• Default user permissions in Microsoft Entra ID Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-DEVICE-007 Enable Windows LAPS backup to Microsoft Entra ID

People and lifecycle