Audit Log for BitLocker Recovery Keys in Azure AD


Escrowing BitLocker recovery keys to Azure AD is great functionality but I have been asked to find an audit trail when a user or administrator accesses the recovery keys. The IT Security function at an organization that I am working with is concerned that a malicious insider could misuse the recovery keys to decrypt drives. They want to track when a Recovery Key is viewed in Azure AD.


I conducted some experiments with administrator and end user accounts but I did not see any audit log entries in the Azure AD audit log.


Are audit log entries created for BitLocker Recovery Key escrow and where would I find the audit logs?

2 Replies

@Andrew Matthews Did you found an answer to this topic?

I have not found any Audit log entry...


@ThomasKurthCH I have not found an answer yet. 


There is a UserVoice item for this feature. Feel free to upvote the UserVoice item.