> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/endpoint/mem/bitlocker-search.md).

# BitLocker Key Search

BitLocker Key Search finds a device's BitLocker recovery key from either the recovery key ID shown on the device's recovery screen or the device's Entra ID device ID. It exists for the situation where a user is locked out and can read out the key ID from the prompt but nobody is sure which tenant, or which device, it belongs to.

## Search

| Field                     | Description                                                                                                                                           |
| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| Lookup Type               | Whether the value entered below is a **Key ID** or a **Device ID**. Key ID is the default.                                                            |
| BitLocker Recovery Key ID | The key identifier shown on the device's BitLocker recovery screen, typically the first eight characters of a GUID. Shown when Lookup Type is Key ID. |
| Azure AD Device ID        | The device's Entra ID device identifier. Shown when Lookup Type is Device ID.                                                                         |

Select **Search** or press Enter to run the search. Results replace those from any previous search.

{% hint style="info" %}
Setting the tenant selector to All Tenants searches every tenant at once, which is the point of the page when a user reads out a key ID and the tenant is unknown. Selecting a single tenant narrows the search to that customer.
{% endhint %}

## Results

Each matching key is returned as its own card, split into details of the key itself and, where the device could be identified, details of the device it belongs to.

### BitLocker Key Information

| Field        | Description                                                                                                  |
| ------------ | ------------------------------------------------------------------------------------------------------------ |
| Key ID       | The identifier of the recovery key that matched.                                                             |
| Volume Type  | Which volume the key unlocks: Operating System Volume, Fixed Data Volume, Removable Data Volume, or Unknown. |
| Created      | When the key was escrowed.                                                                                   |
| Tenant       | The tenant the key was found in, which is what identifies the customer when searching across all of them.    |
| Recovery Key | A **Retrieve Key** button. Selecting it fetches the recovery key and displays it with a copy control.        |

### Device Information

Shown where the device the key belongs to could be identified.

| Field            | Description                                       |
| ---------------- | ------------------------------------------------- |
| Device Name      | The name of the device.                           |
| Device ID        | The device's identifier.                          |
| Operating System | The device's operating system and version.        |
| Account Status   | Whether the device object is enabled or disabled. |
| Trust Type       | How the device is joined to the directory.        |
| Last Sign In     | When the device last signed in or last synced.    |

Where the device cannot be identified, the card shows a notice in place of this section instead. The key details and the **Retrieve Key** button remain usable, so a key can still be recovered for a device that has since been deleted.

{% hint style="warning" %}
The search runs against CIPP's cached copy of each tenant's escrowed key records, not against Graph directly. A key that has been escrowed since the last cache collection will not be found, and neither will a device that has not yet been collected, which is the usual reason the device details are missing from an otherwise valid result.
{% endhint %}

{% hint style="danger" %}
The recovery key itself is not held in the cache. **Retrieve Key** fetches it live and shows it in plain text, and every retrieval is written to the CIPP audit log against the account that performed it.
{% endhint %}

***

## Feature Requests / Ideas

We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.cipp.app/user-documentation/endpoint/mem/bitlocker-search.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.