Audit Log for BitLocker Recovery Keys in Azure AD

Highlighted
Contributor

Escrowing BitLocker recovery keys to Azure AD is great functionality but I have been asked to find an audit trail when a user or administrator accesses the recovery keys. The IT Security function at an organization that I am working with is concerned that a malicious insider could misuse the recovery keys to decrypt drives. They want to track when a Recovery Key is viewed in Azure AD.

 

I conducted some experiments with administrator and end user accounts but I did not see any audit log entries in the Azure AD audit log.

 

Are audit log entries created for BitLocker Recovery Key escrow and where would I find the audit logs?

2 Replies
Highlighted

@Andrew Matthews Did you found an answer to this topic?

I have not found any Audit log entry...

Highlighted

@ThomasKurthCH I have not found an answer yet. 

 

There is a UserVoice item for this feature. Feel free to upvote the UserVoice item.

 

https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/35097220-bitlocker