How to Manage Local Admin Passwords with Windows LAPS and Microsoft Entra

Shared local administrator passwords are a classic lateral-movement path. Windows LAPS gives each device a unique, rotating local admin password and, for Entra-joined devices, stores it in Microsoft Entra ID. This guide follows Microsoft’s Entra scenario page.

Before you start

• Supported OS: Windows 11, Windows 10, and Windows Server 2025, 2022 and 2019.
• Microsoft’s page doesn’t state licensing requirements or name the roles needed to enable the feature. Confirm both in your tenant before rollout.

Step 1: Enable LAPS at the tenant level

By default Entra ID doesn’t let managed devices post new Windows LAPS passwords. An IT admin must first enable the feature for the tenant. Microsoft links a separate article, “Enabling Windows LAPS with Microsoft Entra ID”, for those steps.

Step 2: Deploy the device policy

Settings that apply in Entra mode: BackupDirectory, PasswordAgeDays, PasswordComplexity, PasswordLength, AdministratorAccountName, PostAuthenticationResetDelay and PostAuthenticationActions. Active Directory-specific settings aren’t supported for Entra backup.

• Minimum requirement: set BackupDirectory to 1 (back up to Entra ID).
• Account: if AdministratorAccountName is unset, LAPS manages the built-in administrator, identified by its well-known RID since the name varies by locale.
• Custom accounts: LAPS doesn’t create them. Create the account yourself; Microsoft recommends the Accounts CSP.

Step 3: Apply and verify

Windows LAPS processes policy hourly. To force it, run:

Invoke-LapsPolicyProcessing

Then check the event log for event ID 10029, which confirms a successful password update.

Step 4: Retrieve the password

The Entra and Intune admin portals both offer a retrieval UI. Windows itself has none for Entra-stored passwords. For PowerShell:

1. Install the module: Install-Module Microsoft.Graph -Scope AllUsers
2. Register an Entra app with Device.Read.All plus either DeviceLocalCredential.ReadBasic.All (metadata such as backup time and expiry) or DeviceLocalCredential.Read.All (includes clear-text passwords, so treat it as sensitive).
3. Sign in: Connect-MgGraph -Environment Global -TenantId <tenant-id> -ClientId <app-id>
4. Retrieve: Get-LapsAADPassword -DeviceIds myAzureDevice -IncludePasswords -AsPlainText

Without -IncludePasswords you get metadata only. Add -Verbose for detail.

Step 5: Rotate on demand

Reset-LapsPassword

LAPS rotates automatically at expiration. Use the command for early rotation, such as after a suspected breach. Entra doesn’t support expiring a stored password by editing its expiration timestamp, unlike AD-based LAPS. Avoid excessive calls, which may be throttled.

Lock down access

Microsoft tells you to review membership of the built-in Entra roles that can read stored passwords by default, and calls them highly privileged. The page doesn’t name the roles. It also says nothing about Entra audit logs; the only logging it covers is the Windows event log.

Quick checklist

• Feature enabled in the Entra tenant
• BackupDirectory = 1 deployed via Intune
• Custom admin account created if you don’t use the built-in one
• Event 10029 seen on a test device
• Password-reader roles reviewed

Sources

• Windows LAPS scenarios – Microsoft Entra ID – Microsoft Learn