Give every Windows device its own admin password with LAPS and Intune

If every Windows device shares the same local admin password, one leaked password opens them all. Windows LAPS gives each device its own local admin password, rotates it, and backs it up so you can look it up when you need it. With Intune and Entra ID, you can switch it on without touching a single device.

Before you start

Windows devices enrolled in Microsoft Intune.
LAPS itself is available with Microsoft Entra ID Free or higher. Intune has its own licensing.
To switch LAPS on in Entra you need at least the Cloud Device Administrator role.
To create the policy you need Intune rights from the Security baselines category, which the built-in Endpoint Security Manager role includes.
The policy manages an existing account. It doesn't create one, and it manages only one account per device.

Part 1: Switch LAPS on in Entra ID

Sign in to the Microsoft Entra admin center.
Go to Entra ID > Devices > Overview > Device settings.
Find Enable Local Administrator Password Solution (LAPS) and select Yes.
Select Save.

Part 2: Create the LAPS policy in Intune

Sign in to the Microsoft Intune admin center.
Go to Endpoint security > Account protection > Create Policy.
Set Platform to Windows and Profile to Local admin password solution (Windows LAPS), then select Create.
On Basics, give it a clear Name, such as WIN - LAPS - All devices, and a short Description.
On Configuration settings, set Backup Directory. Choose the directory that matches how your devices are joined: Microsoft Entra ID for Entra-joined devices, Active Directory for devices joined to on-premises AD.
Once you pick a directory, more settings appear, including the password age. Set it to suit your policy.
Leave Administrator Account Name blank to manage the built-in administrator account, or enter the name of the local admin account you already use.
On Scope tags, add tags if you use them, then select Next.
On Assignments, choose a device group. Start with a small test group.
On Review + create, select Create.

Watch out: the backup directory must match the join type. Microsoft says an Active Directory backup on an Entra-only device applies without error but never backs up the password. Also, Intune LAPS settings override Group Policy and legacy Microsoft LAPS, and conflicting LAPS policies can stop backups altogether. Check for existing LAPS GPOs or Intune profiles before you assign this widely.

Microsoft recommends assigning LAPS policy to device groups, not user groups. A user-group assignment follows the user between devices and can cause conflicts.

Part 3: Look up a device's password

In the Intune admin center, go to Devices > All devices and select the Windows device.
On the device Overview, under Monitor, select Local admin password.
You'll see the Account name, Security ID, the hidden Local admin password, and the last and next rotation times in UTC.
Select Show to reveal the password, or Copy to copy it.

Viewing a password creates an audit event, which is what you want. You need an Entra role with the deviceLocalCredentials read permission, such as Cloud Device Administrator. Passwords backed up to on-premises Active Directory can't be viewed here.

Part 4: Rotate the password after you've used it

Go to Devices > All devices and select the device.
Select the … on the menu bar, then Rotate Local admin password.
Confirm the warning. Under Device actions status, it shows Pending and then Complete.

Entra-joined devices must be online when you request a rotation, or it fails. You can only rotate one device at a time, and a device that has never backed up its password can't be rotated. Rotating also resets the password age timer.

Check it worked

Give the test devices time to check in. Nothing shows in the admin center until a device has processed the policy.
Open a test device in Intune and confirm Local admin password shows an account, a password and a next rotation time.
Sign in to that device with the account and the password from Intune. If it works, LAPS is managing it.
Rotate it, wait for Complete, and confirm the old password no longer works.
When the test group looks right, widen the assignment.

Sources

← All tutorials