Deploy Windows LAPS with Intune and Entra ID

Windows LAPS is built into supported Windows versions, so there's no agent to install. It backs up to Entra ID only from devices that are Microsoft Entra joined or hybrid joined. Entra registered (personal or workplace-joined) devices aren't supported. If the old Microsoft LAPS MSI is still installed on your devices, plan to remove it; the Intune policy takes precedence over it and over Group Policy, but two sets of settings are hard to troubleshoot.

Decide now who should see passwords. Reading a password needs the Entra permission microsoft.directory/deviceLocalCredentials/password/read, which Cloud Device Administrator and Intune Administrator have. Helpdesk Administrator, Security Administrator and Security Reader can only see metadata such as the last rotation time. For a service desk, a custom Entra role with just the password read permission is the tidy option (custom roles need Entra ID P1).

Entra ID rejects password backups until this tenant-wide switch is on. In the Microsoft Entra admin center, as at least a Cloud Device Administrator, go to Entra ID → Devices → Overview → Device settings, set Enable Local Administrator Password Solution (LAPS) to Yes and select Save.

If you script tenant settings, the same switch is on the Graph deviceRegistrationPolicy resource, which is a beta endpoint.

In the Intune admin center, go to Endpoint security → Account protection → Create Policy. Choose platform Windows and profile Local admin password solution (Windows LAPS), then give it a name such as LAPS - Entra backup - Pilot. Suggested settings:

Backup Directory: back up the password to Microsoft Entra ID only. The other settings that appear depend on this choice.

Password Age Days: 30. The minimum is 7 when backing up to Entra ID, and the maximum is 365.

Administrator Account Name: leave blank to manage the built-in Administrator account, which Windows finds by its well-known RID whatever it's called. Only fill this in for a custom account, and make sure that account exists first, because LAPS won't create it.

Password Complexity: large letters, small letters, numbers and special characters (value 4, the default). Values 5 to 8, including passphrases, need Windows 11 24H2 or later.

Password Length: 20. Anything from 8 to 64 is allowed.

Post Authentication Actions: reset the password and log off the managed account (value 3, the default).

Post Authentication Reset Delay: 8 hours. The range is 0 to 24, and 0 turns post-authentication actions off.

Assign the policy to your device group. Microsoft recommends device groups rather than user groups, so the settings don't change when a different person signs in.

LAPS manages the built-in Administrator's password even while the account is disabled, which it is by default. Someone has to enable the account before the password is any use. On Windows 11 24H2 and later, the automatic account management settings in the same profile can create or enable the account for you.

Windows LAPS processes its policy every hour. Once Intune has delivered the policy, you can skip the wait by running this in an elevated PowerShell window on the test device, then checking the LAPS event log for event 10029, which means the password was backed up to Entra ID.

1
2
3Invoke-LapsPolicyProcessing
Get-WinEvent -LogName "Microsoft-Windows-LAPS/Operational" -MaxEvents 20 |
  Where-Object Id -eq 10029 | Select-Object TimeCreated, Message

In Event Viewer the same log is at Applications and Services Logs → Microsoft → Windows → LAPS → Operational. Event 10027 means the password didn't meet the device's local password policy, so raise the length or complexity.

In Intune, go to Devices → All devices, select the device, and under Monitor select Local admin password. You'll see the account name, its SID, the last and next rotation times in UTC, and a hidden password you can reveal with Show. Intune only shows passwords backed up to Entra ID, not to on-premises Active Directory.

In the Entra admin center, Entra ID → Devices → Overview → Local administrator password recovery lists every device that has backed up a password, and you can recover a password from there too. Every recovery is written to the audit log, whichever portal you use.

Windows LAPS includes Get-LapsAADPassword, a wrapper around Microsoft Graph PowerShell. It needs Device.Read.All plus either DeviceLocalCredential.ReadBasic.All (metadata only) or DeviceLocalCredential.Read.All (metadata and passwords). Microsoft's walkthrough registers a dedicated app with those permissions and connects with its client ID, which is a good idea in production because it keeps the sensitive permission off the shared Graph PowerShell app. For a lab, delegated scopes are enough.

1
2
3
4
5
6
7Connect-MgGraph -Scopes "Device.Read.All","DeviceLocalCredential.Read.All"
# Metadata only
Get-LapsAADPassword -DeviceIds "LAB-PC-01"
# Password as a SecureString
Get-LapsAADPassword -DeviceIds "LAB-PC-01" -IncludePasswords
# Clear text, for testing only
Get-LapsAADPassword -DeviceIds "LAB-PC-01" -IncludePasswords -AsPlainText

-DeviceIds accepts a device name or the Entra device ID. If you call the Graph API directly instead, the password comes back Base64 encoded.

Rotate straight after a password has been read out on a support call, or after any suspected compromise. In Intune, open the device, select the … menu and choose Rotate local admin password. The action shows as pending, then complete. The device must be online, rotation is one device at a time, and a manual rotation restarts the Password Age Days clock.

The Intune permission for this is Remote tasks: Rotate Local Admin Password, together with Managed devices: Read and Organization: Read. Microsoft's docs say it isn't in any built-in Intune role, so create a custom Intune role for whoever needs it.

On the device itself, an administrator can force a rotation and the new password is backed up straight away:

Reset-LapsPassword

Don't run Reset-LapsPassword in a tight loop; frequent use can be throttled. Unlike the Active Directory version, you can't force a rotation by editing the expiry time in Entra ID.

In the Entra admin center, go to Entra ID → Devices → Overview → Audit logs and filter Activity on Recover device local administrator password (someone read a password) or Update device local administrator password (a device backed up a new one). If you send audit logs to Log Analytics, this query shows who read which device's password:

1
2
3
4
5
6AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName == "Recover device local administrator password"
| project TimeGenerated, Who = tostring(InitiatedBy.user.userPrincipalName),
          Device = tostring(TargetResources[0].displayName), Result
| order by TimeGenerated desc

Remember that deleting a device from Entra ID deletes its stored LAPS password with it. Before you clean up stale devices, make sure nobody still needs to get into them.