get devices without bitlocker recovery key in azure

function Get-MgGraphAllPages {
    <#
    .SYNOPSIS
    Function make sure that all api call pages are returned a.k.a. all results.

    .DESCRIPTION
    Function make sure that all api call pages are returned a.k.a. all results.

    .PARAMETER NextLink
    For internal use.

    .PARAMETER SearchResult
    For internal use.

    .PARAMETER AsHashTable
    Switch to return results as hashtable.
    By default returns pscustomobject.

    .EXAMPLE
    Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/beta/deviceAppManagement/mobileApps" | Get-MgGraphAllPages

    .NOTES
    Based on https://dev.to/celadin/get-mggraphallpages-the-mggraph-missing-command-45b5.
    #>

    [CmdletBinding(
        ConfirmImpact = 'Medium',
        DefaultParameterSetName = 'SearchResult'
    )]
    param (
        [Parameter(Mandatory = $true, ParameterSetName = 'NextLink', ValueFromPipelineByPropertyName = $true)]
        [ValidateNotNullOrEmpty()]
        [Alias('@odata.nextLink')]
        [string] $NextLink
        ,
        [Parameter(ParameterSetName = 'SearchResult', ValueFromPipeline = $true)]
        [PSObject] $SearchResult
        ,
        [switch] $AsHashTable
    )

    begin {}

    process {
        if (!$SearchResult) { return }

        if ($PSCmdlet.ParameterSetName -eq 'SearchResult') {
            # Set the current page to the search result provided
            $page = $SearchResult

            # Extract the NextLink
            $currentNextLink = $page.'@odata.nextLink'

            # We know this is a wrapper object if it has an "@odata.context" property
            #if (Get-Member -InputObject $page -Name '@odata.context' -Membertype Properties) {
            # MgGraph update - MgGraph returns hashtables, and almost always includes .context
            # instead, let's check for nextlinks specifically as a hashtable key
            if ($page.ContainsKey('@odata.count')) {
                Write-Verbose "First page value count: $($Page.'@odata.count')"
            }

            if ($page.ContainsKey('@odata.nextLink') -or $page.ContainsKey('value')) {
                $values = $page.value
            } else {
                # this will probably never fire anymore, but maybe.
                $values = $page
            }

            # Output the values
            if ($values) {
                if ($AsHashTable) {
                    # Default returned objects are hashtables, so this makes for easy pscustomobject conversion on demand
                    $values | Write-Output
                } else {
                    $values | ForEach-Object { [pscustomobject]$_ }
                }
            }
        }

        while (-Not ([string]::IsNullOrWhiteSpace($currentNextLink))) {
            # Make the call to get the next page
            try {
                $page = Invoke-MgGraphRequest -Uri $currentNextLink -Method GET
            } catch {
                throw $_
            }

            # Extract the NextLink
            $currentNextLink = $page.'@odata.nextLink'

            # Output the items in the page
            $values = $page.value

            if ($page.ContainsKey('@odata.count')) {
                Write-Verbose "Current page value count: $($Page.'@odata.count')"
            }

            if ($AsHashTable) {
                # Default returned objects are hashtables, so this makes for easy pscustomobject conversion on demand
                $values | Write-Output
            } else {
                $values | ForEach-Object { [pscustomobject]$_ }
            }
        }
    }

    end {}
}

function Get-BitlockerEscrowStatusForAzureADDevices {
    <#
      .SYNOPSIS
      Retrieves bitlocker key upload status for Windows Azure AD devices

      .DESCRIPTION
      Use this report to determine which of your devices have backed up their bitlocker key to AzureAD (and find those that haven't and are at risk of data loss!).

      .NOTES
    https://msendpointmgr.com/2021/01/18/get-intune-managed-devices-without-an-escrowed-bitlocker-recovery-key-using-powershell/
    #>

    [cmdletbinding()]
    param()

    $null = Connect-MgGraph -Scopes BitLockerKey.ReadBasic.All, DeviceManagementManagedDevices.Read.All

    $recoveryKeys = Invoke-MgGraphRequest -Uri "beta/informationProtection/bitlocker/recoveryKeys?`$select=createdDateTime,deviceId" | Get-MgGraphAllPages

    $aadDevices = Invoke-MgGraphRequest -Uri "v1.0/deviceManagement/managedDevices?`$filter=operatingSystem eq 'Windows'&select=azureADDeviceId,deviceName,id,userPrincipalName,isEncrypted,managedDeviceOwnerType,deviceEnrollmentType" | Get-MgGraphAllPages

    $aadDevices | select *, @{n = 'ValidRecoveryBitlockerKeyInAzure'; e = {
            $deviceId = $_.azureADDeviceId
            $enrolledDateTime = $_.enrolledDateTime
            $validRecoveryKey = $recoveryKeys | ? { $_.deviceId -eq $deviceId -and $_.createdDateTime -ge $enrolledDateTime }
            if ($validRecoveryKey) { $true } else { $false } }
    }
}

Get-BitlockerEscrowStatusForAzureADDevices