Get-BitLockerRecoveryKeyReport

<#
.SYNOPSIS
    Reports BitLocker recovery key escrow status per device.

.DESCRIPTION
    Cross references managed Windows devices against escrowed BitLocker
    recovery keys in Entra ID, flagging devices that appear encrypted
    but have no recoverable key on file, before someone gets locked out
    with no way back in.

.EXAMPLE
    .\Get-BitLockerRecoveryKeyReport.ps1

.NOTES
    Requires Microsoft.Graph.DeviceManagement and
    Microsoft.Graph.Identity.DirectoryManagement with an active
    Connect-MgGraph session and BitlockerKey.Read.All scope.

.AUTHOR
    Shehryar Hassan
#>

$devices = Get-MgDeviceManagementManagedDevice -Filter "operatingSystem eq 'Windows'" -All
$keys = Get-MgInformationProtectionBitlockerRecoveryKey -All

$report = foreach ($device in $devices) {
    $hasKey = $keys | Where-Object { $_.DeviceId -eq $device.AzureAdDeviceId }
    [pscustomobject]@{
        DeviceName = $device.DeviceName
        Owner      = $device.UserPrincipalName
        HasRecoveryKey = [bool]$hasKey
    }
}

$report | Where-Object { -not $_.HasRecoveryKey } | Format-Table -AutoSize
Write-Warning "$(($report | Where-Object { -not $_.HasRecoveryKey }).Count) device(s) have no escrowed BitLocker recovery key."