Created by Claude - please verify

Escrow gaps - metadata only: this report never reads a password or recovery key.

Required Microsoft Graph permissions

DeviceLocalCredential.ReadBasic.All BitLockerKey.ReadBasic.All DeviceManagementManagedDevices.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Intune; Windows LAPS enabled in Entra ID device settings.

Endpoints: GET /v1.0/directory/deviceLocalCredentials (no credentials) · GET /v1.0/informationProtection/bitlocker/recoveryKeys (no key material) · GET /v1.0/deviceManagement/managedDevices

Use the ReadBasic permissions only - DeviceLocalCredential.Read.All and BitLockerKey.Read.All would expose the secrets themselves. If one source is not granted, its column shows n/a instead of false findings.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Windows LAPS & BitLocker Escrow Gaps

Two secrets must be in Entra ID before something goes wrong: the BitLocker recovery key (or the device's data is gone when it locks out) and the Windows LAPS local-administrator password (or support cannot log in when the device loses trust). Windows devices missing either are listed first.

Intune returned no Windows devices.