CIS.M365.5.1.4.6 - (L2) Ensure users are restricted from recovering BitLocker keys

Contributed by Jan BakkerAll contributors →

Overview

5.1.4.6 (L2) Ensure users are restricted from recovering BitLocker keys

This setting determines if users can self-service recover their BitLocker key(s). Restricting non-admin users from being able to see the BitLocker key(s) for their owned devices is the recommended state.

Rationale

Restricting user access to the self-service BitLocker recovery key portal helps mitigate the risk of recovery key exposure in the event of a compromised user account. If an attacker gains access to both the user's credentials and the physical device, they could potentially retrieve the recovery key and decrypt sensitive data. The recovery key itself is also considered sensitive information.

Impact

Users will no longer be able to retrieve their own BitLocker recovery key(s) from the My Account portal or the Microsoft Entra admin center. They'll need to contact a Cloud Device Administrator, Helpdesk Administrator, Intune Administrator, Security Administrator, or Security Reader to recover the key, which increases the support burden during device recovery scenarios.

Remediation action

1. Navigate to Microsoft 365 Entra admin center.
2. Click to expand Entra ID and select Devices > Device settings.
3. Set Restrict non-admin users from recovering the BitLocker key(s) for their owned devices to Yes.
4. Click the Save option at the top of the window.

Alternatively, use Microsoft Graph PowerShell:

Connect-MgGraph -Scopes Policy.ReadWrite.Authorization
$params = @{
 defaultUserRolePermissions = @{
  allowedToReadBitlockerKeysForOwnedDevice = $false
 }
}
Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy" -Body $params

Related links

• Microsoft 365 Entra admin center - Device settings
• Manage devices in Microsoft Entra ID using the Microsoft Entra admin center
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 235

Test Metadata

Field	Value
Test ID	CIS.M365.5.1.4.6
Severity	Medium
Suite	CIS
Product	Entra ID
Feature	Device identity
Area	Access control
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1552 Unsecured Credentials
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.1.4.6
Benchmark level	L2
Benchmark profiles	E3 Level 2, E5 Level 2
Supports controls	cis-m365:5.1.4.6, nist-800-53-r5:AC-6(10), nist-800-53-r5:SC-28(3)
PowerShell test	Test-MtCisEnsureBitLockerKeyRecoveryRestricted
Services	Graph

Source

• Test: tests/cis/Test.CIS.M365.5.1.4.6.ps1
• Documentation: tests/cis/Test.CIS.M365.5.1.4.6.md