Get-MgInformationProtectionBitlockerRecoveryKey not retrieving key?

Yes, this is by design.

Get-MgInformationProtectionBitlockerRecoveryKey retrieves the BitLocker recovery key object, but does not return the actual recovery key value (key property) by default. The cmdlet description explicitly states that the operation doesn't return the key property unless it is explicitly selected.

To retrieve the recovery key itself, the runbook must:

1. Use an identity (service principal/managed identity) that has one of these Microsoft Graph application permissions:
   • BitlockerKey.ReadBasic.All
   • BitlockerKey.Read.All
2. Call the cmdlet with the -Property "key" parameter (which maps to $select=key in Graph):

      Import-Module Microsoft.Graph.Identity.SignIns
      
      Get-MgInformationProtectionBitlockerRecoveryKey \
          -BitlockerRecoveryKeyId $bitlockerRecoveryKeyId \
          -Property "key"
   

Including the key property triggers a Microsoft Entra audit of the operation and generates an audit log under the KeyManagement category.

If -Property "key" is omitted, the cmdlet will return only the metadata of the BitLocker recovery key object, not the recovery key itself.

References:

• Get-MgInformationProtectionBitlockerRecoveryKey
• BitLocker Recovery Key not found - Microsoft Q&A
• I recently got the trap screen for the Bit Locker Recovery. I know I set this PC up Under This Email and the code is not showing. - Microsoft Q&A
• Bitlocker keys gone. - Microsoft Q&A
• Bitlocker recovery - Microsoft Q&A
• BITLOCKER recover key failed to unlock - Microsoft Q&A