Enable Windows LAPS backup to Microsoft Entra ID

Description

The device setting Enable Microsoft Entra Local Administrator Password Solution (LAPS) is set to Yes, and a client-side Windows LAPS policy (Intune Endpoint security > Account protection > Local admin password solution (Windows LAPS), or Group Policy for hybrid devices) backs up the password of the managed local administrator account to Microsoft Entra ID and rotates it.

The tenant setting alone does nothing: it allows devices to store passwords in Entra ID. The client policy decides which account is managed, the backup directory, password complexity, length and age.

Rationale

A local administrator account with the same password on every device lets an attacker who compromises one endpoint reuse the hash or password on all others (pass-the-hash, lateral movement). Windows LAPS gives every device a unique random password, rotates it, and records every retrieval in the Entra audit log.

Impact

None for users. Helpdesk staff retrieve the password from the device page in Entra ID or Intune instead of a shared value; grant only them the right to read LAPS passwords (Cloud Device Administrator, or a custom role with microsoft.directory/deviceLocalCredentials/password/read). Requires Windows 10 or 11 (April 2023 update or later) or Windows Server 2019/2022; Entra registered devices are not supported. When a device object is deleted, its stored password is lost.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Devices > Device settings and check that Enable Microsoft Entra Local Administrator Password Solution (LAPS) is Yes.
3. Browse to Entra ID > Devices > Overview > Local administrator password recovery and check that Windows devices are listed with a recent rotation date (metadata readable by Security Reader).
4. In the Intune admin center, browse to Endpoint security > Account protection and check that a Local admin password solution (Windows LAPS) policy with Backup Directory set to Microsoft Entra ID is assigned to all Windows devices.
5. Alternative, read only: Invoke-MgGraphRequest -Method GET -Uri https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy and read localAdminPassword.isEnabled; GET https://graph.microsoft.com/v1.0/directory/deviceLocalCredentials (scope DeviceLocalCredential.ReadBasic.All) lists devices with a backed-up password.
6. Fail if the tenant setting is No, or if no client policy backs up passwords for the Windows fleet.

Remediation

1. Browse to Entra ID > Devices > Device settings, set Enable Microsoft Entra Local Administrator Password Solution (LAPS) to Yes and save. Role: Cloud Device Administrator.
2. In the Intune admin center, browse to Endpoint security > Account protection > Create Policy, platform Windows, profile Local admin password solution (Windows LAPS). Set Backup Directory to Backup the password to Microsoft Entra ID only, a password age of 30 days or less, and complexity with at least 14 characters. Assign it to a pilot group, then to all Windows devices. Role: Intune Administrator or Endpoint Security Manager.
3. Graph equivalent for the tenant setting: PUT https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy with localAdminPassword.isEnabled set to true.
4. Protect password recovery: require phishing-resistant MFA for the roles allowed to read LAPS passwords.

Rollback

Unassign the Intune LAPS policy, then set the tenant setting back to No. Passwords already rotated stay valid until changed: recover them before rollback.

References

• Use Windows Local Administrator Password Solution (LAPS) with Microsoft Entra ID Microsoft, vendor-doc, accessed 2026-10-24
• Maester test MT.1177 Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-DEVICE-005 Do not add Global Administrators as local administrators at Entra join
• related CB-M365-DEVICE-006 Do not make the joining user a local administrator at Entra join
• related CB-M365-DEVICE-008 Prevent users from reading the BitLocker recovery keys of their own devices
• related CB-M365-AUTH-004 Require phishing-resistant MFA for administrative roles

People and lifecycle