BitLocker & device encryption

Check Intune BitLocker Policies

Lists the Intune device-configuration and compliance policies related to BitLocker, and their assignments. Note: relies on the deprecated Microsoft.Graph.Intune SDK and may need reworking for current tenants.

Download .ps144 lines · PowerShell

Replace generic placeholder values (tenant, domain, secrets) for your own environment before running. Read it first and test safely.

# Connect to Microsoft 365
Connect-MsolService

# Get all users with their assigned licenses
Get-MsolUser | Select-Object UserPrincipalName, DisplayName, @{Name='Licenses';Expression={$_.Licenses.AccountSkuId}}

# Install the required modules if not already installed
if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Intune)) {
    Install-Module -Name Microsoft.Graph.Intune -Scope CurrentUser -Force
}

# Import the required modules
Import-Module Microsoft.Graph.Intune

# Connect to MS Graph
Connect-MSGraph

# Get all device configuration profiles
$deviceConfigProfiles = Get-DeviceManagement_ConfigurationPolicy

# Filter for BitLocker policies
$bitlockerPolicies = $deviceConfigProfiles | Where-Object {$_.description -like "*BitLocker*"}

# Display the BitLocker policies
$bitlockerPolicies | Select-Object displayName, description

# Get all compliance policies
$compliancePolicies = Get-DeviceManagement_CompliancePolicy

# Filter for BitLocker compliance settings
$bitlockerCompliance = $compliancePolicies | Where-Object {$_.description -like "*BitLocker*"}

# Display the BitLocker compliance policies
$bitlockerCompliance | Select-Object displayName, description

# Get all device assignments
$deviceAssignments = Get-DeviceManagement_ConfigurationPolicyAssignment

# Filter assignments for BitLocker policies
$bitlockerAssignments = $deviceAssignments | Where-Object {$_.target -in $bitlockerPolicies.id}

# Display assigned devices
$bitlockerAssignments | Select-Object target, policyId