Created by Claude - please verify

Recovery secret reads - directory audit events 'Read BitLocker key' and 'Recover device local administrator password', 30 days, grouped per account.

Required Microsoft Graph permissions

AuditLog.Read.All — application permission, granted to the app registration with admin consent.

Licence: None.

Endpoints: GET /v1.0/auditLogs/directoryAudits?$filter=activityDisplayName eq 'Read BitLocker key' · ... activityDisplayName eq 'Recover device local administrator password'

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

BitLocker Key & LAPS Password Retrieval Audit (30 days)

BitLocker recovery keys and LAPS passwords unlock devices. Help-desk staff read them for good reasons, one or two at a time. Dozens in a day, or reads at night, point to an insider or a compromised admin account collecting them.