{
  "id": "CB-M365-DEVICE-008",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-008",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-008.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-008.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-DEVICE-008",
    "title": "Prevent users from reading the BitLocker recovery keys of their own devices",
    "finding": {
      "title": "Users can read the BitLocker recovery keys of devices they own",
      "description": "A user, or an attacker with the user's session, can retrieve the recovery key and unlock the encrypted disk of the user's devices without involving the helpdesk."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "entra-id",
      "bitlocker",
      "encryption",
      "helpdesk",
      "least-privilege"
    ],
    "description": "The device setting **Restrict users from recovering the BitLocker key(s) for their owned\ndevices** is set to **Yes**. Only roles with the BitLocker read permission (Cloud Device\nAdministrator, Helpdesk Administrator, Intune Administrator, Security Administrator, Security\nReader) can display recovery keys, and every display is logged.\n",
    "rationale": "The BitLocker recovery key bypasses the TPM and PIN protectors. If a device owner can read it in\nself-service, an attacker who phishes the user's session, or a user who wants to bypass device\ncontrols (for example to boot another OS or remove the TPM binding), gets it without any human\ncheck. Going through the helpdesk adds identity verification and a trace of who asked for which\nkey.\n",
    "impact": "Users who hit the BitLocker recovery screen can no longer get their key from the My Account or\nCompany Portal pages and must call the helpdesk. Plan the helpdesk procedure (identity check,\nkey retrieval from Entra ID or Intune) before enabling the setting, especially for travelling\nusers.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Devices > Device settings > Restrict users from recovering the BitLocker key(s) for their owned devices",
      "default_value": "No",
      "recommended_value": "Yes"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Devices** > **Device settings**.\n3. Check that **Restrict users from recovering the BitLocker key(s) for their owned devices** is\n   **Yes**.\n4. Alternative, read only: `Invoke-MgGraphRequest -Method GET -Uri\n   https://graph.microsoft.com/v1.0/policies/authorizationPolicy` (scope `Policy.Read.All`) and\n   read `defaultUserRolePermissions.allowedToReadBitlockerKeysForOwnedDevice`.\n5. Fail if the setting is **No** (`allowedToReadBitlockerKeysForOwnedDevice` is `true`).\n"
    },
    "remediation": {
      "manual": "1. Document the helpdesk procedure for BitLocker recovery.\n2. Browse to **Entra ID** > **Devices** > **Device settings**. Role: Privileged Role\n   Administrator.\n3. Set **Restrict users from recovering the BitLocker key(s) for their owned devices** to\n   **Yes** and save.\n4. Graph equivalent: `PATCH https://graph.microsoft.com/v1.0/policies/authorizationPolicy` with\n   body `{\"defaultUserRolePermissions\": {\"allowedToReadBitlockerKeysForOwnedDevice\": false}}`.\n",
      "rollback": "Set the setting back to **No**.\n"
    },
    "references": [
      {
        "title": "Manage devices in Microsoft Entra ID - Configure device settings",
        "url": "https://learn.microsoft.com/entra/identity/devices/manage-device-identities",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Default user permissions in Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/fundamentals/users-default-permissions",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-12",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-DEVICE-007",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}