Microsoft Intune
Windows and macOS devices through Microsoft Graph, including BitLocker key presence and FileVault escrow.
DeviceManagementManagedDevices.Read.AllBitlockerKey.ReadBasic.AllUser.Read.All
Encryption Coverage Mapper
Find every device your encryption missed.
Pull device data from Microsoft Intune or Jamf Pro, or drop in a CSV or Excel file. Every device is classed as compliant, high risk or critical, then mapped by department, region and OS.
Runs entirely on your machine. No account needed.
Illustration: 3D coverage, region × department
0% 100%
Key encryption and recovery metrics, at a glance
Encrypted.Escrowed.Compliant.
450devices in the demo fleet
89.6%encrypted
57.1%key escrowed
Microsoft IntuneJamf ProBitLockerFileVaultMicrosoft Graph
CSVExcelWindowsmacOSiOS & Android
How it works
Encrypted is not enough without the key.
A device is compliant only when it is encrypted and its recovery key is escrowed. Everything else is a gap, ranked by how bad it is.
Critical
Not encrypted. Disk data is readable without authentication.
High
Encrypted, but the recovery key is not escrowed. If the password is lost, so is the data.
Compliant
Encrypted and the key is escrowed. Protected and recoverable.
What you get
Four views. One honest number.
Coverage heatmap
Cross any two of region, department and OS. Cells run red to green, with a stacked bar chart that puts the biggest gaps first.
Gap report
Every non-compliant device in one sortable, filterable table, labelled Critical or High. Export the view to CSV.
Fleet import
Connect Intune or Jamf Pro with read-only access, or upload any CSV or Excel export up to 25 MB.
Stats bar
Always on screen: total devices, encryption %, key-escrow %, compliance score and gap count.
The dashboard
Real screens, real demo data.
Coverage heatmap, region by department, using the bundled demo fleet.
Gap report: search, sort, export.
Import from Intune, Jamf Pro or a file.
Data sources
Plug into what you already run.
Jamf Pro
Mac computers from the Jamf Pro REST API (10.35 or later): FileVault state, recovery key, user and department.
Read ComputersRead Computer Inventory CollectionRead DepartmentsCSV or Excel
Any export. Four required columns, the rest optional, and a sample template built in.
device_iddevice_nameosencryption_status
Download
Version 1.0.0
Try it first: demo_fleet.csv or .xlsx
All releases and checksums
These builds are not code-signed. On Windows choose More info, then Run anyway. On macOS right-click the app and choose Open.
Privacy
Your fleet data never leaves your machine.
- Runs locallyDevice data goes only to the Intune or Jamf service you choose to connect.
- Held in the sessionLoaded data lives in the browser session and clears on refresh.
- No account, no cookiesNo sign-up for the app, and no tracking cookies on this site.
FAQ
Good to know.
Why do all my Windows devices show "key not escrowed"?
The Azure app registration is missing BitlockerKey.ReadBasic.All, or admin consent has not been granted. The app still loads and shows a warning.
Why are my devices all under "Unassigned"?
The department lookup failed. For Intune, grant User.Read.All. For Jamf, add Read Departments to the API role.
How long does Intune take on a large fleet?
User lookups run in parallel, up to 15 at once. Expect roughly 30 to 60 seconds for fleets above 5,000 devices.
Does it work without Intune or Jamf?
Yes. Upload a CSV or Excel file with the four required columns.
Can I export results?
Yes. The gap report exports the current filtered view to a timestamped CSV.