BitlockerKey.Read.All
Allows an app to read BitLocker keys for all devices, without a signed-in user. Allows read of the recovery key.
In short
BitlockerKey.Read.All is available as both an application permission and a delegated permission in the Microsoft Graph API, grouped under the BitlockerKey category. Allows an app to read BitLocker keys for all devices, without a signed-in user. Allows read of the recovery key. It grants read-only access to resources. Application permissions always require admin consent.
Permission Details
Read all BitLocker keys
Allows an app to read BitLocker keys for all devices, without a signed-in user. Allows read of the recovery key.
57f1cf28-c0c4-4ec3-9a30-19a2eaaf2f6e
Read BitLocker keys
Allows the app to read BitLocker keys on behalf of the signed-in user, for their owned devices. Allows read of the recovery key.
b27a61ec-b99c-4d6a-b126-c4375d08ae30
Properties
Properties is shown from stable Microsoft Graph v1.0 metadata.
| Property | Type | Description |
|---|---|---|
bitlocker |
object |
|
threatAssessmentRequests |
threatAssessmentRequest collection |
JSON Representation
JSON representation is shown from stable Microsoft Graph v1.0 metadata.
{
"@odata.type": "#microsoft.graph.bitlocker"
}Relationships
Relationships is shown from stable Microsoft Graph v1.0 metadata.
| Relationship | Type | Description |
|---|---|---|
recoveryKeys |
bitlockerRecoveryKey collection |
The recovery keys associated with the bitlocker entity. |
threatAssessmentRequests |
threatAssessmentRequest collection |
Related threatAssessmentRequests data exposed by this resource. |
dataLossPreventionPolicies |
dataLossPreventionPolicy collection |
Related dataLossPreventionPolicies data exposed by this resource. |
sensitivityLabels |
sensitivityLabel collection |
Related sensitivityLabels data exposed by this resource. |
Graph Methods
Microsoft Graph v1.0 endpoints are mapped directly from refreshed Microsoft Learn permissions tables.
Microsoft Graph beta endpoints are mapped directly from refreshed Microsoft Learn permissions tables.
Microsoft Graph PowerShell v1.0 commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.
Microsoft Graph PowerShell beta commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.
Code Examples
// Code snippets are only available for the latest version. Current version is 5.x
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.InformationProtection.Bitlocker.RecoveryKeys["{bitlockerRecoveryKey-id}"].GetAsync((requestConfiguration) =>
{
requestConfiguration.Headers.Add("User-Agent", "Dsreg/10.0");
requestConfiguration.Headers.Add("ocp-client-name", "My Friendly Client");
requestConfiguration.Headers.Add("ocp-client-version", "1.2");
});const options = {
authProvider,
};
const client = Client.init(options);
let bitlockerRecoveryKey = await client.api('/informationProtection/bitlocker/recoveryKeys/b465e4e8-e4e8-b465-e8e4-65b4e8e465b4')
.header('User-Agent','Dsreg/10.0')
.header('ocp-client-name','My Friendly Client')
.header('ocp-client-version','1.2')
.get();Import-Module Microsoft.Graph.Identity.SignIns
Get-MgInformationProtectionBitlockerRecoveryKey -BitlockerRecoveryKeyId $bitlockerRecoveryKeyId# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.information_protection.bitlocker.recovery_keys.item.bitlocker_recovery_key_item_request_builder import BitlockerRecoveryKeyItemRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_configuration = RequestConfiguration()
request_configuration.headers.add("User-Agent", "Dsreg/10.0")
request_configuration.headers.add("ocp-client-name", "My Friendly Client")
request_configuration.headers.add("ocp-client-version", "1.2")
result = await graph_client.information_protection.bitlocker.recovery_keys.by_bitlocker_recovery_key_id('bitlockerRecoveryKey-id').get(request_configuration = request_configuration)App Registration
Navigate to Azure Portal
Go to App registrations in Microsoft Entra admin center
Add API Permission
Select your app → API permissions → Add a permission → Microsoft Graph
Select Permission Type
Choose Application permissions or delegated permissions and search for BitlockerKey.Read.All
Grant Admin Consent
Application permissions always require admin consent.
Frequently asked questions
What is the BitlockerKey.Read.All Microsoft Graph permission?
BitlockerKey.Read.All is available as both an application permission and a delegated permission in the Microsoft Graph API, grouped under the BitlockerKey category. Allows an app to read BitLocker keys for all devices, without a signed-in user. Allows read of the recovery key. It grants read-only access to resources. Application permissions always require admin consent. It is mapped to the Microsoft Graph bitlocker resource type. 7 documented Microsoft Graph REST methods require it. 4 Microsoft Graph PowerShell commands are documented for it.
Is BitlockerKey.Read.All an application or a delegated permission?
BitlockerKey.Read.All is available as both an application permission (app-only access, no signed-in user) and a delegated permission (access on behalf of a signed-in user).
Does BitlockerKey.Read.All require admin consent?
Application permissions always require admin consent.
What is the permission ID (GUID) for BitlockerKey.Read.All?
For BitlockerKey.Read.All, the application (app role) ID is 57f1cf28-c0c4-4ec3-9a30-19a2eaaf2f6e, and the delegated (OAuth2 scope) ID is b27a61ec-b99c-4d6a-b126-c4375d08ae30. These are the real Microsoft Graph identifiers and can be used directly in an app registration manifest.