Back to Checks
m365

Non-admin users cannot read BitLocker keys for their owned devices

entra_policy_default_user_cannot_read_bitlocker_keys
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accessencryptione3
Resource Type:NotDefined

Microsoft Entra tenant's authorization policy should restrict non-admin users from reading (self-recovering) BitLocker recovery keys for devices they own. Restricting self-service recovery reduces the risk of an attacker who has compromised a user account from also recovering the disk-encryption key of that user's device.

Prowler logoProwlerprowler-provider-m365

Risk

If a user can retrieve the BitLocker recovery key for their own device, an attacker who compromises the account can decrypt the device's disk, exposing data at rest. Recovery-key access should be limited to administrators and controlled recovery workflows.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_policy_default_user_cannot_read_bitlocker_keys

Recommendation

Disable self-service BitLocker recovery-key access for non-admin users so that recovery keys can only be retrieved by administrators through a controlled process.

Remediation

Other

1Navigate to the Microsoft Entra admin center at https://entra.microsoft.com/
2Go to **Identity** > **Devices** > **All devices** > **Device settings**
3Set **Users can recover BitLocker key(s) for their owned devices** to **No**
4Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client


class entra_policy_default_user_cannot_read_bitlocker_keys(Check):
    """Check if default users are restricted from reading BitLocker keys for their owned devices.

    This check verifies whether the authorization policy prevents non-admin users
    from self-recovering BitLocker keys for devices they own in Microsoft Entra ID.

    - PASS: Non-admin users cannot read BitLocker keys for their owned devices.
    - FAIL: Non-admin users are allowed to read BitLocker keys for their owned devices.
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for BitLocker key self-recovery restrictions.

        Returns:
            List[CheckReportM365]: A list containing the result of the check.
        """
        findings = []
        auth_policy = entra_client.authorization_policy

        report = CheckReportM365(
            metadata=self.metadata(),
            resource=auth_policy if auth_policy else {},
            resource_name=auth_policy.name if auth_policy else "Authorization Policy",
            resource_id=auth_policy.id if auth_policy else "authorizationPolicy",
        )
        report.status = "FAIL"
        report.status_extended = "Non-admin users are allowed to read BitLocker keys for their owned devices."

        if (
            getattr(auth_policy, "default_user_role_permissions", None)
            and getattr(
                auth_policy.default_user_role_permissions,
                "allowed_to_read_bitlocker_keys_for_owned_device",
                None,
            )
            is False
        ):
            report.status = "PASS"
            report.status_extended = "Non-admin users are not allowed to read BitLocker keys for their owned devices."

        findings.append(report)
        return findings

References