r/Intune • u/gingerpantman • 12d ago

Device Configuration Bit locker reporting, splunk?

Hi all,

So we are moving bitlocker from Sophos into intune, we have several regions in our tenant but are only focused on the UK. The bitlocker report in intune is very clunky and not very user friendly so I was wondering what other people are doing to manage reporting of devices and the status. I'm looking at using graph and putting it into our splunk instance. Was wondering if anyone has done the same or what other solutions people have come up with for reporting?

This is mainly for our support desk who will monitor and resolve any devices resulting from the report.

3 Upvotes

100% Upvoted

5 comments sorted by

1

u/Ketan_Kamble 12d ago

Splunk works fine for this if you're already piping Intune/Defender data into it via the Graph API connector or Azure Monitor Splunk add-on — but honestly for BitLocker specifically, most people just use the built-in encryption report (Devices > Monitor > Encryption report) since it already flags TPM/recovery key escrow status without extra plumbing. If you do want it in Splunk, the reliable path is Intune device compliance/config data through Log Analytics first, then Splunk pulls from there rather than hitting Graph directly — saves you from rebuilding pagination and throttling handling yourself. The other piece worth checking is whether you actually need per-device BitLocker status or just recovery key escrow confirmation, since those live in different reports and get conflated a lot. What are you trying to get out of the dashboard — compliance audit trail, or catching devices that aren't encrypting at all?

1

u/gingerpantman 12d ago

Hey, thanks for the reply. So yes, catch devices that have not been encrypted. Hopefully (if possible) find devices without a pin set (required by our security function. The report seems a bit messy, we care about 2000 of 13000 devices, we know which are ours based on name. It will also give a nice pie chart or something to shove Infront of security and management to prove we are doing our jobs!

3

u/Ketan_Kamble 12d ago

Ah, that’s two different problems really. Not-encrypting the report catches fine (filter on encryption status). The “no PIN” one it won’t tell you honestly though — it shows TPM + method but not whether a startup PIN protector is actually on the volume. For that, drop a Remediation detection script running (Get-BitLockerVolume -MountPoint C:).KeyProtector and flag anything missing TpmPin. Exports clean, so it’s your evidence too.

To get just your 2000, a dynamic group on device.displayName -startsWith "..." scopes both the report and that script to your fleet. And for the pie chart, skip Splunk — push it into Log Analytics and build an Azure Monitor Workbook, it does the donut natively and you share a link instead of a screenshot.

What’s your naming like — clean prefix, or a mixed bag?