azureblog.co.uk
← cd ~/graph-permissions
// graph-permissions · BitlockerKey

BitlockerKey.ReadBasic.AllMicrosoft Graph permission · Medium risk

Allows an app to read basic BitLocker key properties for all devices, without a signed-in user. Does not allow read of the recovery key.

Application permission

Medium risk

Read all BitLocker keys basic information. Allows an app to read basic BitLocker key properties for all devices, without a signed-in user. Does not allow read of the recovery key.

IDf690d423-6b29-4d04-98c6-694c42282419
ConsentAlways needs admin consent
RiskReads data across the tenant without a signed-in user.

Delegated permission

Low risk

Read BitLocker keys basic information. Allows the app to read basic BitLocker key properties on behalf of the signed-in user, for their owned devices. Does not allow read of the recovery key itself.

ID5a107bfc-4f00-4e1a-b67e-66451267bc68
ConsentNeeds admin consent
RiskRead access, limited to what the signed-in user can see.

Grant it to an app

In the portal: App registrations › your app › API permissions › Add a permission › Microsoft Graph › Application permissions, then grant admin consent. Or with Graph PowerShell:

powershell5 lines
Connect-MgGraph -Scopes "Application.Read.All", "AppRoleAssignment.ReadWrite.All"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
$app   = Get-MgServicePrincipal -Filter "appId eq '<your app's client id>'"
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $app.Id `
    -PrincipalId $app.Id -ResourceId $graph.Id -AppRoleId "f690d423-6b29-4d04-98c6-694c42282419"

Ask for it when signing in

Delegated permissions act as the signed-in user, so the app can never do more than that user can.

powershell1 line
Connect-MgGraph -Scopes "BitlockerKey.ReadBasic.All"

Which apps already have it?

powershell6 lines
# Apps that hold BitlockerKey.ReadBasic.All as an application permission
Connect-MgGraph -Scopes "Application.Read.All"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $graph.Id -All |
    Where-Object AppRoleId -eq "f690d423-6b29-4d04-98c6-694c42282419" |
    Select-Object PrincipalDisplayName, PrincipalId, CreatedDateTime
powershell6 lines
# Apps with delegated consent for BitlockerKey.ReadBasic.All
Connect-MgGraph -Scopes "Application.Read.All", "Directory.Read.All"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
Get-MgOauth2PermissionGrant -All |
    Where-Object { $_.ResourceId -eq $graph.Id -and ($_.Scope -split " ") -contains "BitlockerKey.ReadBasic.All" } |
    Select-Object ClientId, ConsentType, PrincipalId

Other BitlockerKey permissions

Check every app in your tenant → Permission explainer

Sources