Deploy Windows LAPS with Intune and Microsoft Entra ID

Windows LAPS can rotate a device’s local administrator password and back it up to Microsoft Entra ID. Intune can deploy the policy and request a one-device rotation. This guide targets a small Entra-joined or hybrid-joined Windows pilot group. It complements the site’s AD-backed Windows LAPS guide.

One backup destination per device

A Windows LAPS device cannot back up the same managed password to both AD DS and Microsoft Entra ID. Inventory existing GPO, legacy LAPS, and Intune policy assignments before piloting cloud backup. An Intune Windows LAPS CSP setting takes precedence over corresponding GPO or legacy settings, and conflicting Intune policies can prevent processing.

01

Check Licensing, Join State, and Current Policy

Prerequisites

Confirm the tenant has Intune licensing and Windows LAPS is supported on the pilot devices. Use Entra-joined or hybrid-joined devices for Entra backup; workplace-joined devices are not supported for Intune LAPS policy. Record the existing managed local admin account, current backup destination, and all assigned LAPS profiles or GPOs. Intune policy does not create a local account.

# Run on a pilot Windows device.
dsregcmd.exe /status
Get-LocalUser | Select-Object Name, Enabled, SID
Get-WinEvent -ListLog 'Microsoft-Windows-LAPS/Operational' |
  Select-Object LogName, IsEnabled

❯ What to Verify

AzureAdJoined or DomainJoined/DeviceId state matches the intended join type.
The managed local account exists and existing LAPS policy sources are known.

Choose the account deliberately

If Administrator Account Name is blank in Intune, Windows LAPS targets the built-in local Administrator account by its well-known RID, even if it was renamed. A named account must already exist on each device. Do not assign a policy for an account that is absent.

02

Enable Windows LAPS in Microsoft Entra

Tenant Setup

With an authorized tenant administrator, open the Microsoft Entra admin center. Go to Entra ID > Devices > Overview > Device settings, set Enable Local Administrator Password Solution (LAPS) to Yes, and select Save. Record the change. Wait for the setting to apply before deploying the device policy.

Microsoft Entra admin center > Entra ID > Devices > Overview > Device settings
Enable Local Administrator Password Solution (LAPS): Yes > Save

❯ What to Verify

Entra LAPS is enabled for the tenant; the change owner and time are recorded.

03

Create a Pilot Device Group and Policy

Intune Policy

Create a small device group. In the Intune admin center, open Endpoint security > Account protection, then create a Windows Local admin password solution (Windows LAPS) profile. Choose Microsoft Entra ID as the backup directory and define approved password age, length, complexity, and any post-authentication action. Assign the profile to the pilot device group only. Avoid overlapping LAPS profiles for the same devices.

Intune admin center > Endpoint security > Account protection > Create Policy
Platform: Windows
Profile: Local admin password solution (Windows LAPS)
Backup directory: Microsoft Entra ID
Assignment: pilot device group

❯ What to Verify

One LAPS profile targets each pilot device and selects Entra backup.
Password settings match the organization's local-account standard.

04

Verify Device Policy and Cloud Backup

Validation

Sync a pilot device from Intune and allow policy processing. Review the profile’s device status and the Windows LAPS Operational event log on the device. Then open the device in Intune > Devices > All devices > selected device > Local admin password. Confirm the account name and rotation timestamps appear. A device status of Success is useful, but actual backup evidence is required before using password recovery.

Get-WinEvent -LogName 'Microsoft-Windows-LAPS/Operational' -MaxEvents 20 |
  Select-Object TimeCreated, Id, LevelDisplayName, Message

❯ What to Verify

Recent LAPS events show successful policy processing and backup.
The Intune device pane shows account and rotation details for Entra backup.

Password retrieval is a privileged, audited action

Restrict clear-text password read permission to approved support roles or a narrowly scoped custom Entra role. Do not paste recovered passwords into tickets, chats, transcripts, or screenshots. Viewing a password and requesting a manual rotation create audit records.

05

Delegate and Test Password Recovery

Access Control

Review the Microsoft Entra role permissions needed for local credential reading and give them only to the approved recovery team. Have an authorized pilot operator open the device’s Local admin password pane and reveal the password for a documented test. Confirm an unauthorized test operator cannot reveal it. Check tenant audit logs for the read event.

Intune > Devices > All devices > pilot device > Local admin password
Approved operator: Show password for a documented recovery test
Unapproved operator: verify that clear-text access is denied

❯ What to Verify

Only approved operators can read the password, and the recovery action
is visible in the organization's audit trail.

06

Rotate One Pilot Password and Close the Pilot

Rotation

After backup is confirmed, select one online pilot device and choose Rotate local admin password from its device actions. This is a real password change: coordinate with anyone using that local account. Wait for the action to complete, then verify a newer rotation timestamp and successful LAPS events. Do not use a broad device action; Intune rotation is one device at a time. If it fails, inspect join state, policy conflicts, connectivity, account existence, and the LAPS Operational log before retrying.

Intune > Devices > All devices > pilot device > ... > Rotate local admin password
Then review: Device actions status > Complete
              Local admin password > Last password rotation

❯ What to Verify

The device action completes, the cloud rotation timestamp advances,
and the local LAPS log confirms the new backup cycle.

Primary references

See Microsoft’s Intune Windows LAPS overview, Entra LAPS setup guide, LAPS policy deployment guide, and Windows LAPS architecture.