# Windows LAPS with Entra ID and Intune: rotate local admin passwords

> Enable Windows LAPS in Microsoft Entra ID, deploy an Intune policy that backs up and rotates the local administrator password, and retrieve it securely.

Source: https://www.epifive.com/blog/windows-laps-entra-id-intune · Published 2026-10-20 · EpiFive

Windows LAPS (Local Administrator Password Solution) is built into Windows and can back up the managed local administrator password to Microsoft Entra ID and rotate it on a schedule. To use it with Intune you do three things: enable LAPS in the Entra device settings, assign an Intune endpoint security policy that sets the backup directory to Microsoft Entra ID, and grant the right Entra roles to the people who need to read the password.

The result is a unique, random password on every device, stored encrypted in the directory, with audit events each time it is rotated or recovered.

## Who this is for and what you will have at the end

This guide is for Intune and Entra administrators who manage Microsoft Entra joined or Microsoft Entra hybrid joined Windows devices and still rely on a shared local administrator password, or on the legacy Microsoft LAPS tool.

By the end you will have:

- LAPS enabled for your tenant in Microsoft Entra ID.
- An Intune policy that manages the built-in local administrator account (or a named one) with a password length, complexity and rotation interval you choose.
- A verified password retrieval path through the Intune admin center, the Entra admin center and PowerShell.
- A least-privilege role setup and an audit query for password recovery.
- A troubleshooting list for the usual failures.

## How Windows LAPS with Entra ID works

Every Windows device has a built-in local administrator account. If its password is the same across devices, one stolen hash gives lateral movement everywhere. Windows LAPS gives each device its own password and rotates it.

Three pieces are involved:

| Piece | Where it lives | What it does |
| --- | --- | --- |
| Tenant switch | Entra device settings | Allows Entra joined devices to back up LAPS passwords to the tenant |
| Client policy | Delivered by Intune through the Windows LAPS configuration service provider (CSP) | Sets the backup directory, account, password rules and rotation schedule |
| Role permissions | Microsoft Entra RBAC | Decides who can read password metadata and the password itself |

Intune policies manage LAPS through the Windows LAPS CSP. Settings from the CSP take precedence over, and overwrite, configuration from other LAPS sources such as Group Policy or legacy Microsoft LAPS. That is useful during migration, because the Intune policy wins without you having to clean up the old configuration first.

Windows LAPS manages a single local administrator account per device. Intune policy does not create new accounts or passwords for you on most Windows versions; it manages an account that already exists. The exception is automatic account management, covered below.

## Prerequisites

### Supported devices and join types

Devices must be Microsoft Entra joined or Microsoft Entra hybrid joined. Microsoft Entra registered (workplace-joined) devices are not supported. Windows LAPS is not supported on non-Windows platforms; macOS has a separate LAPS implementation in Intune.

The device must run a Windows version that includes the LAPS CSP. Intune documents these minimums:

| Windows version | Minimum build / update |
| --- | --- |
| Windows 11 22H2 | 22621.1555 or later (KB5025239) |
| Windows 11 21H2 | 22000.1817 or later (KB5025224) |
| Windows 10 22H2 | 19045.2846 or later (KB5025221) |
| Windows 10 21H2 | 19044.2846 or later (KB5025221) |
| Windows 10 20H2 | 19042.2846 or later (KB5025221) |
| Windows 10 Enterprise LTSC 2019 and later LTSC | Supported |

Windows 10 reached end of support on 14 October 2025. Intune lists it as an allowed version, but functionality is not guaranteed.

### Licensing

LAPS is available with Microsoft Entra ID Free or higher. Intune policy needs at least Microsoft Intune Plan 1. A trial subscription works. Custom Entra roles need Entra ID P1 or P2.

### Roles you need to do the setup

| Task | Role or permission |
| --- | --- |
| Enable LAPS in Entra device settings | At least Cloud Device Administrator |
| Create and assign the Intune policy | Rights from the Security baselines category; included in the Endpoint Security Manager built-in role |
| View the password | Entra permission `microsoft.directory/deviceLocalCredentials/password/read` (Cloud Device Administrator or Intune Administrator include it) |
| Rotate the password from Intune | Managed devices: Read, Organization: Read, Remote tasks: Rotate Local Admin Password |

The Rotate Local Admin Password remote task is not part of any Intune built-in role or the Entra Intune Administrator role, so you need a custom Intune role to grant it. For general guidance on keeping these assignments narrow, see [least-privilege Entra admin roles](https://www.epifive.com/blog/entra-admin-roles-least-privilege).

## Step 1: Enable LAPS in Microsoft Entra ID

This step is required for Microsoft Entra joined devices. Microsoft Entra hybrid joined devices do not require LAPS to be enabled in Entra, but turning it on does no harm if you have both kinds.

1. Sign in to the Microsoft Entra admin center as at least a Cloud Device Administrator.
2. Browse to **Entra ID** > **Devices** > **Overview** > **Device settings**. Some Intune pages label the first node **Identity**; the portal navigation has changed between releases.
3. Set **Enable Local Administrator Password Solution (LAPS)** to **Yes** and select **Save**.

You can also do this through the Microsoft Graph `Update deviceRegistrationPolicy` API, which is documented in the beta endpoint.

## Step 2: Create the Intune LAPS policy

LAPS lives under endpoint security account protection, not under device configuration profiles.

1. Sign in to the Microsoft Intune admin center and go to **Endpoint security** > **Account protection**, then select **Create Policy**.
2. Set **Platform** to **Windows** and **Profile** to **Local admin password solution (Windows LAPS)**, then select **Create**.
3. On **Basics**, give the policy a descriptive name, for example `Windows LAPS - Entra ID backup`.
4. On **Configuration settings**, set **Backup Directory** to the Microsoft Entra ID option. The directory you pick decides which other settings appear.
5. Configure the remaining settings (see the next section).
6. Add scope tags if you use them, then assign the policy.
7. On **Review + create**, select **Create**.

Assign the policy to device groups, not user groups. A policy assigned to a user group follows the user from device to device, so when a different person signs in, a different policy can apply and change which account is backed up or when the next rotation happens.

Assign one LAPS policy per device. The CSP supports a single configuration for each LAPS setting, and devices that receive conflicting settings from several policies can fail to process the policy and fail to back up the account.

### Settings worth deciding on

The Intune policy exposes the settings of the Windows LAPS CSP. These are the ones that matter most, with the values Microsoft documents for the setting of the same name.

| Setting | Documented values | Default if not set |
| --- | --- | --- |
| BackupDirectory | 0 Disabled, 1 Microsoft Entra only, 2 Active Directory only | 0 (Disabled) |
| AdministratorAccountName | Account name; leave empty for the built-in administrator | Built-in administrator, found by its well-known RID |
| PasswordAgeDays | 1 to 365; minimum 7 when the backup directory is Entra ID | 30 |
| PasswordLength | 8 to 64 characters | 14 |
| PasswordComplexity | 1 to 4 letters/numbers/special combinations; 5 to 8 add readable variants and passphrases | 4 (upper, lower, numbers, special characters) |
| PassphraseLength | 3 to 10 words | 6 |
| PostAuthenticationResetDelay | 0 to 24 hours; 0 disables post-authentication actions | 24 |
| PostAuthenticationActions | 1 reset password, 3 reset and sign out, 5 reset and reboot, 11 reset, sign out and terminate remaining processes | 3 |

A few points that save time:

- Microsoft recommends keeping `PasswordComplexity` at 4 or higher. Values 1 to 3 exist only for backward compatibility with legacy Microsoft LAPS.
- `PasswordLength` is ignored unless complexity is one of the password options, and `PassphraseLength` is ignored unless it is one of the passphrase options.
- `PasswordComplexity` values 5 to 8, `PassphraseLength` and `PostAuthenticationActions` value 11 are supported only on Windows 11 24H2, Windows Server 2025 and later. If you send them to an older build, that build falls back to the default value, so use separate policies for older and newer operating systems.
- Do not choose a length or complexity that conflicts with the device's local password policy. Windows LAPS then cannot create a compatible password, and the Windows LAPS event log records event 10027.
- Changing `PasswordAgeDays` does not change the expiry of the current password and does not trigger a rotation.
- If you manage a custom account name, the account must already exist. Windows LAPS does not create it, and on Windows 11 23H2 or earlier a name that does not exist has no effect and raises no error.

### Post-authentication actions

After someone authenticates with the managed account, Windows LAPS waits for the reset delay and then resets the password and takes the configured action. With the defaults (24 hours, action 3), the password is reset and sign-in sessions using the account are ended 24 hours after use. Note that sign-out and reboot actions can cause data loss for anyone still working in the session, so choose them deliberately.

### Automatic account management on Windows 11 24H2

On Windows 11 24H2 and later you can let Windows LAPS manage the account itself. The related settings are `AutomaticAccountManagementEnabled`, `AutomaticAccountManagementTarget` (0 for the built-in Administrator, 1 for a new custom account), `AutomaticAccountManagementNameOrPrefix` (default `WLapsAdmin`), `AutomaticAccountManagementEnableAccount` and `AutomaticAccountManagementRandomizeName`. With randomisation on, the name gets a random six-digit suffix at every rotation, and the base name is truncated beyond 14 characters because local account names are limited to 20. When automatic account management is enabled, `AdministratorAccountName` is ignored.

## Step 3: Assign the roles that read passwords

Read access is separate from Intune access. Entra defines two relevant actions:

- `microsoft.directory/deviceLocalCredentials/password/read` returns metadata and the password.
- `microsoft.directory/deviceLocalCredentials/standard/read` returns metadata only (device name, last and next rotation).

| Built-in role | Password and metadata | Metadata only |
| --- | --- | --- |
| Cloud Device Administrator | Yes | Yes |
| Intune Administrator | Yes | Yes |
| Helpdesk Administrator | No | Yes |
| Security Administrator | No | Yes |
| Security Reader | No | Yes |

If service-desk staff need the password but nothing else, create a custom role containing `password/read`. Custom roles need Entra ID P1 or P2. You can also create an administrative unit, add the devices and assign Cloud Device Administrator scoped to that unit, which limits password recovery to those devices. To keep executive devices out of reach of tenant-wide admins, see [restricted management administrative units](https://www.epifive.com/blog/restricted-management-administrative-units).

Conditional Access can protect password recovery by targeting the built-in roles that hold the permission, for example by requiring multifactor authentication for administrators. Microsoft notes that administrative unit-scoped roles and custom roles are not supported as Conditional Access targets for this purpose, so a custom role would escape that policy.

## Step 4: Verify the policy and the backup

Allow the device to check in with Intune. Until it processes the policy, no LAPS data is available in the admin center.

### In the Intune admin center

1. Go to **Devices** > **All devices** and select a Windows device that received the policy.
2. Under **Monitor**, select **Local admin password**.
3. Confirm you see the account name, security ID, last password rotation and next password rotation. Select **Show** to reveal the password, and **Copy** to copy it.

Viewing a password triggers an audit event. You cannot view passwords for devices that back up to on-premises Active Directory. The Intune pane shows the same data as the Entra portal.

### In the Microsoft Entra admin center

Browse to **Entra ID** > **Devices** > **Overview** > **Local administrator password recovery** to list all devices with a LAPS password stored.

### With PowerShell

The `Get-LapsAADPassword` cmdlet in the Windows LAPS module queries Microsoft Graph. It needs the Microsoft Graph PowerShell module installed, and a Graph session with the right permissions:

- `DeviceLocalCredential.ReadBasic.All` for metadata only.
- `DeviceLocalCredential.Read.All` to include passwords.
- `Device.Read.All` when you pass a device name instead of a device ID.

```powershell
Connect-MgGraph -Scopes 'DeviceLocalCredential.Read.All','Device.Read.All'

# Metadata only: expiry time of the current password
Get-LapsAADPassword -DeviceIds 'LAPT-0142'

# Include the password (returned as a SecureString)
Get-LapsAADPassword -DeviceIds 'LAPT-0142' -IncludePasswords

# Include previous passwords as well
Get-LapsAADPassword -DeviceIds 'LAPT-0142' -IncludePasswords -IncludeHistory
```

Avoid `-AsPlainText` outside of support or testing situations, because it prints the clear-text password to the console. If two devices in the tenant share a name, the cmdlet fails; pass the device ID instead. If you call the Graph API directly, the returned password is Base64 encoded and must be decoded before use.

## Step 5: Rotate a password on demand

Scheduled rotation follows `PasswordAgeDays`. To rotate sooner, for example after a technician has used the account:

1. In **Devices** > **All devices**, select the device.
2. Open the ellipsis (...) menu on the device toolbar and select **Rotate local admin password**.
3. Confirm the warning. The action shows as Pending in **Device actions status** and normally completes within a few minutes.

Keep these constraints in mind:

- It works on one device at a time; there is no bulk action.
- For Entra joined devices, the device must be online when you request the rotation, otherwise it fails.
- A device that has never successfully backed up its account cannot complete a rotation request.
- A manual rotation resets the schedule. If `PasswordAgeDays` is 10 and you rotate on day 4, the next automatic rotation is 10 days after day 4.

## Auditing password updates and recovery

Every scheduled rotation, manual rotation and password view generates an audit event. In the Entra admin center, go to **Entra ID** > **Devices** > **Overview** > **Audit logs**, filter **Activity**, and search for:

- **Update device local administrator password**
- **Recover device local administrator password**

To see Intune-side LAPS policy and device action events, your account needs permissions equivalent to the Read Only Operator Intune role. If you route Entra logs to a workspace for retention, you can alert on the recovery activity; the setup is covered in [sending Entra sign-in and audit logs to Log Analytics](https://www.epifive.com/blog/entra-logs-log-analytics-retention).

## Troubleshooting

| Symptom | Likely cause | Fix |
| --- | --- | --- |
| Policy shows success but no password in Entra | LAPS not enabled in Entra device settings (Entra joined devices) | Enable **Enable Local Administrator Password Solution (LAPS)** and let the device sync |
| Policy applies, backup never happens | Backup Directory is Active Directory but the device is Entra joined only | Set Backup Directory to Microsoft Entra ID; the directory must match the join type |
| Both policies show a conflict | Two LAPS policies with different values for the same setting | Remove assignments or align the settings; for a device that already has a working policy, the previous values stay in place until the conflict is resolved |
| Intune-managed device ignores GPO settings | Intune CSP takes precedence over Group Policy | Expected; remove the GPO or accept the CSP values |
| Event 10027 in the Windows LAPS log | Password length or complexity incompatible with local password policy | Align the LAPS settings with the device's local password policy |
| Local admin password button greyed out | Missing Intune permission | Grant the Rotate Local Admin Password remote task through a custom Intune role |
| Passphrase setting seems ignored | Device runs a build older than Windows 11 24H2 | Use a separate policy for older devices, as the default of 4 applies there |
| No rotation for a device | Device is disabled in Entra ID | Windows LAPS needs the device enabled before rotation and backup apply |
| Password lost after cleanup | Device object was deleted in Entra ID | The credential is deleted with the device; there is no recovery without an external export |
| Custom account not managed | Named account does not exist | Create the account first, or use automatic account management on 24H2 |

If a device keeps failing, check its Windows LAPS operational event log locally. Event 10027 is the only event ID whose meaning is confirmed above; look at the other events in that log for the specific failure message on the device itself.

## Rollout checklist

- Confirm devices are Entra joined or hybrid joined, with the required cumulative update.
- Enable LAPS in Entra device settings.
- Create one Windows LAPS policy per device population, with Backup Directory set to Microsoft Entra ID and a `PasswordAgeDays` of at least 7.
- Keep `PasswordComplexity` at 4 or higher and split policies for pre-24H2 and 24H2 devices when using passphrases.
- Assign to device groups only, and check for conflicting policies.
- Verify one pilot device in Intune, in the Entra portal and with `Get-LapsAADPassword`.
- Create a custom Intune role for password rotation and decide who gets `password/read`.
- Protect the privileged roles with Conditional Access and review the audit events for recovery.
- Remove old shared local administrator passwords from documentation and scripts once the pilot is stable.

For the Autopilot side of getting devices into this state, see [Windows Autopilot with Intune: an end-to-end deployment guide](https://www.epifive.com/blog/intune-windows-autopilot-deployment-guide).

## References

- https://learn.microsoft.com/en-us/entra/identity/devices/howto-manage-local-admin-passwords
- https://learn.microsoft.com/en-us/intune/device-security/laps/overview
- https://learn.microsoft.com/en-us/intune/device-security/laps/deploy-policy
- https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-policy-settings
- https://learn.microsoft.com/en-us/powershell/module/laps/get-lapsaadpassword

## Frequently asked questions

### Does Windows LAPS with Entra ID need a paid licence?

Microsoft documents that LAPS is available to all customers with Microsoft Entra ID Free or higher. For Intune policy you need at least Microsoft Intune Plan 1, which can be a trial. Related features such as administrative units, custom roles and Conditional Access have their own licensing requirements.

### Why does the Intune policy apply but no password appears in Entra ID?

The most common causes are that LAPS is not enabled in the Entra device settings for an Entra joined device, that the policy's Backup Directory is set to Active Directory on a device that is not domain joined, or that two conflicting LAPS policies are assigned to the same device. The device must also check in with Intune and process the policy before any data shows up.

### Can I rotate the local admin password for many devices at once?

Not from the Intune admin center. The Rotate local admin password device action works on one device at a time and is not supported as a bulk action. For Entra joined devices the device must also be online when you request the rotation.

### What happens to the stored password if I delete the device in Entra ID?

The LAPS credential tied to the device is lost, and Entra ID has no method to recover it. Unless you built a workflow that exports passwords to an external store, you must regain access to the device another way.