Windows LAPS with Entra ID and Intune: rotate local admin passwords

Windows LAPS (Local Administrator Password Solution) is built into Windows and can back up the managed local administrator password to Microsoft Entra ID and rotate it on a schedule. To use it with Intune you do three things: enable LAPS in the Entra device settings, assign an Intune endpoint security policy that sets the backup directory to Microsoft Entra ID, and grant the right Entra roles to the people who need to read the password.

The result is a unique, random password on every device, stored encrypted in the directory, with audit events each time it is rotated or recovered.

Who this is for and what you will have at the end

This guide is for Intune and Entra administrators who manage Microsoft Entra joined or Microsoft Entra hybrid joined Windows devices and still rely on a shared local administrator password, or on the legacy Microsoft LAPS tool.

By the end you will have:

• LAPS enabled for your tenant in Microsoft Entra ID.
• An Intune policy that manages the built-in local administrator account (or a named one) with a password length, complexity and rotation interval you choose.
• A verified password retrieval path through the Intune admin center, the Entra admin center and PowerShell.
• A least-privilege role setup and an audit query for password recovery.
• A troubleshooting list for the usual failures.

How Windows LAPS with Entra ID works

Every Windows device has a built-in local administrator account. If its password is the same across devices, one stolen hash gives lateral movement everywhere. Windows LAPS gives each device its own password and rotates it.

Three pieces are involved:

Intune policies manage LAPS through the Windows LAPS CSP. Settings from the CSP take precedence over, and overwrite, configuration from other LAPS sources such as Group Policy or legacy Microsoft LAPS. That is useful during migration, because the Intune policy wins without you having to clean up the old configuration first.

Windows LAPS manages a single local administrator account per device. Intune policy does not create new accounts or passwords for you on most Windows versions; it manages an account that already exists. The exception is automatic account management, covered below.

Prerequisites

Supported devices and join types

Devices must be Microsoft Entra joined or Microsoft Entra hybrid joined. Microsoft Entra registered (workplace-joined) devices are not supported. Windows LAPS is not supported on non-Windows platforms; macOS has a separate LAPS implementation in Intune.

The device must run a Windows version that includes the LAPS CSP. Intune documents these minimums:

Windows 10 reached end of support on 14 October 2025. Intune lists it as an allowed version, but functionality is not guaranteed.

Licensing

LAPS is available with Microsoft Entra ID Free or higher. Intune policy needs at least Microsoft Intune Plan 1. A trial subscription works. Custom Entra roles need Entra ID P1 or P2.

Roles you need to do the setup

The Rotate Local Admin Password remote task is not part of any Intune built-in role or the Entra Intune Administrator role, so you need a custom Intune role to grant it. For general guidance on keeping these assignments narrow, see least-privilege Entra admin roles.

Step 1: Enable LAPS in Microsoft Entra ID

This step is required for Microsoft Entra joined devices. Microsoft Entra hybrid joined devices do not require LAPS to be enabled in Entra, but turning it on does no harm if you have both kinds.

1. Sign in to the Microsoft Entra admin center as at least a Cloud Device Administrator.
2. Browse to Entra ID > Devices > Overview > Device settings. Some Intune pages label the first node Identity; the portal navigation has changed between releases.
3. Set Enable Local Administrator Password Solution (LAPS) to Yes and select Save.

You can also do this through the Microsoft Graph Update deviceRegistrationPolicy API, which is documented in the beta endpoint.

Step 2: Create the Intune LAPS policy

LAPS lives under endpoint security account protection, not under device configuration profiles.

1. Sign in to the Microsoft Intune admin center and go to Endpoint security > Account protection, then select Create Policy.
2. Set Platform to Windows and Profile to Local admin password solution (Windows LAPS), then select Create.
3. On Basics, give the policy a descriptive name, for example Windows LAPS - Entra ID backup.
4. On Configuration settings, set Backup Directory to the Microsoft Entra ID option. The directory you pick decides which other settings appear.
5. Configure the remaining settings (see the next section).
6. Add scope tags if you use them, then assign the policy.
7. On Review + create, select Create.

Assign the policy to device groups, not user groups. A policy assigned to a user group follows the user from device to device, so when a different person signs in, a different policy can apply and change which account is backed up or when the next rotation happens.

Assign one LAPS policy per device. The CSP supports a single configuration for each LAPS setting, and devices that receive conflicting settings from several policies can fail to process the policy and fail to back up the account.

Settings worth deciding on

The Intune policy exposes the settings of the Windows LAPS CSP. These are the ones that matter most, with the values Microsoft documents for the setting of the same name.

A few points that save time:

• Microsoft recommends keeping PasswordComplexity at 4 or higher. Values 1 to 3 exist only for backward compatibility with legacy Microsoft LAPS.
• PasswordLength is ignored unless complexity is one of the password options, and PassphraseLength is ignored unless it is one of the passphrase options.
• PasswordComplexity values 5 to 8, PassphraseLength and PostAuthenticationActions value 11 are supported only on Windows 11 24H2, Windows Server 2025 and later. If you send them to an older build, that build falls back to the default value, so use separate policies for older and newer operating systems.
• Do not choose a length or complexity that conflicts with the device's local password policy. Windows LAPS then cannot create a compatible password, and the Windows LAPS event log records event 10027.
• Changing PasswordAgeDays does not change the expiry of the current password and does not trigger a rotation.
• If you manage a custom account name, the account must already exist. Windows LAPS does not create it, and on Windows 11 23H2 or earlier a name that does not exist has no effect and raises no error.

Post-authentication actions

After someone authenticates with the managed account, Windows LAPS waits for the reset delay and then resets the password and takes the configured action. With the defaults (24 hours, action 3), the password is reset and sign-in sessions using the account are ended 24 hours after use. Note that sign-out and reboot actions can cause data loss for anyone still working in the session, so choose them deliberately.

Automatic account management on Windows 11 24H2

On Windows 11 24H2 and later you can let Windows LAPS manage the account itself. The related settings are AutomaticAccountManagementEnabled, AutomaticAccountManagementTarget (0 for the built-in Administrator, 1 for a new custom account), AutomaticAccountManagementNameOrPrefix (default WLapsAdmin), AutomaticAccountManagementEnableAccount and AutomaticAccountManagementRandomizeName. With randomisation on, the name gets a random six-digit suffix at every rotation, and the base name is truncated beyond 14 characters because local account names are limited to 20. When automatic account management is enabled, AdministratorAccountName is ignored.

Step 3: Assign the roles that read passwords

Read access is separate from Intune access. Entra defines two relevant actions:

• microsoft.directory/deviceLocalCredentials/password/read returns metadata and the password.
• microsoft.directory/deviceLocalCredentials/standard/read returns metadata only (device name, last and next rotation).

If service-desk staff need the password but nothing else, create a custom role containing password/read. Custom roles need Entra ID P1 or P2. You can also create an administrative unit, add the devices and assign Cloud Device Administrator scoped to that unit, which limits password recovery to those devices. To keep executive devices out of reach of tenant-wide admins, see restricted management administrative units.

Conditional Access can protect password recovery by targeting the built-in roles that hold the permission, for example by requiring multifactor authentication for administrators. Microsoft notes that administrative unit-scoped roles and custom roles are not supported as Conditional Access targets for this purpose, so a custom role would escape that policy.

Step 4: Verify the policy and the backup

Allow the device to check in with Intune. Until it processes the policy, no LAPS data is available in the admin center.

In the Intune admin center

1. Go to Devices > All devices and select a Windows device that received the policy.
2. Under Monitor, select Local admin password.
3. Confirm you see the account name, security ID, last password rotation and next password rotation. Select Show to reveal the password, and Copy to copy it.

Viewing a password triggers an audit event. You cannot view passwords for devices that back up to on-premises Active Directory. The Intune pane shows the same data as the Entra portal.

In the Microsoft Entra admin center

Browse to Entra ID > Devices > Overview > Local administrator password recovery to list all devices with a LAPS password stored.

With PowerShell

The Get-LapsAADPassword cmdlet in the Windows LAPS module queries Microsoft Graph. It needs the Microsoft Graph PowerShell module installed, and a Graph session with the right permissions:

• DeviceLocalCredential.ReadBasic.All for metadata only.
• DeviceLocalCredential.Read.All to include passwords.
• Device.Read.All when you pass a device name instead of a device ID.

Connect-MgGraph -Scopes 'DeviceLocalCredential.Read.All','Device.Read.All'
 
# Metadata only: expiry time of the current password
Get-LapsAADPassword -DeviceIds 'LAPT-0142'
 
# Include the password (returned as a SecureString)
Get-LapsAADPassword -DeviceIds 'LAPT-0142' -IncludePasswords
 
# Include previous passwords as well
Get-LapsAADPassword -DeviceIds 'LAPT-0142' -IncludePasswords -IncludeHistory

Avoid -AsPlainText outside of support or testing situations, because it prints the clear-text password to the console. If two devices in the tenant share a name, the cmdlet fails; pass the device ID instead. If you call the Graph API directly, the returned password is Base64 encoded and must be decoded before use.

Step 5: Rotate a password on demand

Scheduled rotation follows PasswordAgeDays. To rotate sooner, for example after a technician has used the account:

1. In Devices > All devices, select the device.
2. Open the ellipsis (...) menu on the device toolbar and select Rotate local admin password.
3. Confirm the warning. The action shows as Pending in Device actions status and normally completes within a few minutes.

Keep these constraints in mind:

• It works on one device at a time; there is no bulk action.
• For Entra joined devices, the device must be online when you request the rotation, otherwise it fails.
• A device that has never successfully backed up its account cannot complete a rotation request.
• A manual rotation resets the schedule. If PasswordAgeDays is 10 and you rotate on day 4, the next automatic rotation is 10 days after day 4.

Auditing password updates and recovery

Every scheduled rotation, manual rotation and password view generates an audit event. In the Entra admin center, go to Entra ID > Devices > Overview > Audit logs, filter Activity, and search for:

• Update device local administrator password
• Recover device local administrator password

To see Intune-side LAPS policy and device action events, your account needs permissions equivalent to the Read Only Operator Intune role. If you route Entra logs to a workspace for retention, you can alert on the recovery activity; the setup is covered in sending Entra sign-in and audit logs to Log Analytics.

Troubleshooting

If a device keeps failing, check its Windows LAPS operational event log locally. Event 10027 is the only event ID whose meaning is confirmed above; look at the other events in that log for the specific failure message on the device itself.

Rollout checklist

• Confirm devices are Entra joined or hybrid joined, with the required cumulative update.
• Enable LAPS in Entra device settings.
• Create one Windows LAPS policy per device population, with Backup Directory set to Microsoft Entra ID and a PasswordAgeDays of at least 7.
• Keep PasswordComplexity at 4 or higher and split policies for pre-24H2 and 24H2 devices when using passphrases.
• Assign to device groups only, and check for conflicting policies.
• Verify one pilot device in Intune, in the Entra portal and with Get-LapsAADPassword.
• Create a custom Intune role for password rotation and decide who gets password/read.
• Protect the privileged roles with Conditional Access and review the audit events for recovery.
• Remove old shared local administrator passwords from documentation and scripts once the pilot is stable.

For the Autopilot side of getting devices into this state, see Windows Autopilot with Intune: an end-to-end deployment guide.

References

• https://learn.microsoft.com/en-us/entra/identity/devices/howto-manage-local-admin-passwords
• https://learn.microsoft.com/en-us/intune/device-security/laps/overview
• https://learn.microsoft.com/en-us/intune/device-security/laps/deploy-policy
• https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-policy-settings
• https://learn.microsoft.com/en-us/powershell/module/laps/get-lapsaadpassword