Get BitLocker Recovery Key from Azure AD

Get-AADBitLockerRcoveryKey.ps1

#Requires -Modules AzureRM.Profile, AzureAD
$DeviceObjectId = '' # Set an objectID for a device
$SubScriptionID = '' # change with your subscription ID

Add-AzureRmAccount
$Subscription = Select-AzureRmSubscription -Subscription $SubScriptionID
$currentAzureContext = Get-AzureRmContext -Name $Subscription.Name
$TenantId = $currentAzureContext.Tenant.Id
$tokenCache = $currentAzureContext.TokenCache
$Cache = $tokenCache.ReadItems().Where({$_.ExpiresOn -gt (Get-Date) -and $_.TenantId -eq $TenantId })[0]
$refreshToken = $Cache.RefreshToken


$body = "grant_type=refresh_token&resource=74658136-14ec-4630-ad9b-26e160ff0fc6&refresh_token=$([System.Web.HttpUtility]::UrlEncode($refreshToken))"
$tokresponse = Invoke-RestMethod "https://login.windows.net/$tenantid/oauth2/token" -Method POST -Body $body -ContentType 'application/x-www-form-urlencoded'
$AccessToken = $tokresponse.access_token



$BaseUri = 'https://main.iam.ad.ext.azure.com/api'
$ApiPath = 'Device'
$GetReqId = (New-Guid).ToString()
$Params = @{
    Headers = @{
        'Authorization'          = 'Bearer {0}' -f $AccessToken
        'x-ms-client-request-id' = $GetReqId
    }
    Uri     = '{0}/{1}/{2}' -f @(
        $BaseUri
        $ApiPath
        $DeviceObjectId
    )
    Method  = 'GET'
    ContentType = 'application/json'
}
$ApiResponse = Invoke-RestMethod @Params

$ApiResponse.bitLockerKey