EBS Analysis: Use Windows Local Administrator Password Solution (LAPS) with Microsoft Entra ID – Microsoft Entra ID

Windows LAPS with Microsoft Entra ID: Architecture, Implementation, and Governance

Modern enterprises face a persistent challenge: the local administrator account on every Windows workstation is a prime target for credential theft and lateral movement. The traditional approach of rotating passwords manually or storing them in a proprietary vault introduces operational overhead and security gaps. Microsoft’s Local Administrator Password Solution (LAPS) addresses these issues by automatically generating, rotating, and storing the local administrator password in a secure directory. With the integration of LAPS into Microsoft Entra ID, organizations can extend these capabilities to cloud‑joined and hybrid‑joined devices, providing a unified experience for identity and device management.

This article explores the architectural foundations of Windows LAPS in the context of Microsoft Entra ID, details how the solution works, and outlines implementation considerations, security and governance controls, operational implications, and common pitfalls. The discussion is tailored for enterprise IT leaders, security architects, and managed service providers seeking to leverage LAPS as part of a zero‑trust strategy.

Architecture and Capabilities

Windows LAPS with Microsoft Entra ID introduces a tenant‑wide policy that enables the backup of local administrator passwords to the cloud directory. The solution comprises two primary components:

• Tenant‑side configuration – An administrative setting in Microsoft Entra ID that activates LAPS for all eligible devices. This setting is applied via the device registration policy and can be configured through the Microsoft Entra admin center or the Microsoft Graph API (Update deviceRegistrationPolicy).
• Client‑side policy – A configuration that defines the local administrator account name, password age, length, complexity, and the destination for password backup. The client‑side policy must set BackUpDirectory to Microsoft Entra ID to direct the stored password to the cloud.

The integration supports the following capabilities:

• Local administrator password management – Organizations can enforce password complexity, expiration, and manual reset options through the LAPS Configuration Service Provider (CSP).
• Recovery experiences – Authorized administrators can retrieve the current local administrator password via the Microsoft Entra admin center, the Microsoft Graph API (Get deviceLocalCredentialInfo), or PowerShell cmdlets. The API returns the password in Base64 encoding, which must be decoded before use.
• Device enumeration – A list of all Windows devices that have LAPS enabled can be obtained through the portal or the Graph API, facilitating inventory and compliance checks.
• Role‑based access control (RBAC) – Password recovery is gated by permissions such as microsoft.directory/deviceLocalCredentials/password/read. Built‑in roles like Cloud Device Administrator and Intune Administrator already possess this permission, while custom roles can be created to granularize access.
• Auditing – All password update and recovery events are logged in the Microsoft Entra audit log. Administrators can filter for activities such as Update device local administrator password or Recover device local administrator password to monitor usage.
• Conditional Access integration – Conditional Access policies can be scoped to the built‑in roles that are authorized for password recovery, enabling requirements such as multifactor authentication or compliant device compliance.

It is important to note that Windows LAPS is supported only on devices that are Microsoft Entra joined or Microsoft Entra hybrid joined. Devices that are merely Microsoft Entra registered (also known as “Bring Your Own Device” scenarios) are not supported. Additionally, LAPS is not available for non‑Windows platforms.

How the Technology Works

When a Windows device is joined to Microsoft Entra ID, the LAPS client agent (integrated into the operating system) periodically generates a new local administrator password according to the configured policy. The password is then encrypted and sent to Microsoft Entra ID, where it is stored as a device attribute. The storage mechanism leverages the same security boundaries that protect other device credentials, ensuring that only users with the appropriate RBAC permissions can retrieve the value.

The retrieval process involves a call to the Get deviceLocalCredentialInfo endpoint. The response includes the password in Base64 format, which the caller must decode. This design prevents plaintext exposure in transit and at rest, while still allowing authorized administrators to obtain the credential when needed.

Metadata such as the device name, last password rotation time, and next scheduled rotation are accessible through the microsoft.directory/deviceLocalCredentials/standard/read permission. This separation of password and metadata allows organizations to enforce different access policies for each.

Implementation Considerations

Deploying Windows LAPS with Microsoft Entra ID requires coordinated actions in both the cloud tenant and on each target device. The following steps outline a typical implementation path:

1. Enable the tenant‑wide policy – Sign in to the Microsoft Entra admin center as a Cloud Device Administrator. Navigate to Entra ID > Devices > Overview > Device settings and set Enable Local Administrator Password Solution (LAPS) to Yes. This action can also be performed via the Graph API by updating the deviceRegistrationPolicy.
2. Configure client‑side policy – Deploy a policy that sets BackUpDirectory to Microsoft Entra ID. If the organization uses Microsoft Intune, the LAPS policy can be created under Endpoint security > Account protection. For environments that rely on Group Policy Objects (GPOs), the policy can be configured using the Windows LAPS ADMX templates and the appropriate GPO links.
3. Assign RBAC permissions – Ensure that administrators who need to recover passwords have been granted the microsoft.directory/deviceLocalCredentials/password/read permission. This can be achieved by assigning built‑in roles (e.g., Cloud Device Administrator, Intune Administrator) or by creating a custom role with the required permission and assigning it to users or groups.
4. Optionally configure Conditional Access – If additional security controls are desired, create a Conditional Access policy that targets the roles authorized for password recovery and enforces requirements such as MFA or device compliance.
5. Verify deployment – Use the Microsoft Entra admin center or Graph API to list devices with LAPS enabled, and check the audit log for initial password generation events.

Prerequisites include:

• Windows 11 22H2 (April 11, 2023 update) or later, Windows 11 21H2 (April 11, 2023 update), Windows 10 20H2/21H2/22H2 (April 11, 2023 update), Windows Server 2022 (April 11, 2023 update), or Windows Server 2019 (November 2023 update).
• Microsoft Entra ID Free or higher license. Features such as administrative units, custom roles, Conditional Access, and Intune may require additional licensing (e.g., Microsoft Entra ID P1/P2, Microsoft 365 E3/E5).
• Devices must be Microsoft Entra joined or hybrid joined; Entra registered devices are not supported.

Security and Governance

The security model of LAPS in Microsoft Entra ID relies on several layers of protection:

• Encryption – Passwords are encrypted before being stored in the directory, ensuring that they are not readable by unauthorized users.
• RBAC – Access to password retrieval is strictly controlled by role assignments. The built‑in roles that include the password/read permission are limited to Cloud Device Administrator and Intune Administrator. Custom roles can be created to provide more granular access, and they can be scoped to administrative units.
• Auditing – Every password update and recovery operation is recorded in the audit log, providing a trail for compliance and incident response.
• Conditional Access – Administrators can require multifactor authentication, compliant devices, or location‑based conditions before a password can be recovered, aligning with zero‑trust principles.

Governance considerations include:

• Administrative units – Devices can be grouped into administrative units, and the Cloud Device Administrator role can be scoped to a specific unit, allowing delegated administration without exposing the entire tenant.
• Custom roles – Organizations can define roles that include only the standard/read permission for metadata, or both standard/read and password/read for full access.
• Lifecycle management – When a device is deleted from Microsoft Entra ID, the associated LAPS credential is permanently removed. Organizations must have a backup or external storage mechanism if they need to retain password history beyond the device lifecycle.

Operational Implications

Adopting LAPS changes the routine for local administrator password management:

• Automated rotation – Passwords are automatically rotated based on the configured age, reducing the need for manual changes and minimizing the window of exposure.
• Centralized retrieval – Administrators can retrieve passwords from a single console (Microsoft Entra admin center) or via API, eliminating the need for on‑premises vaults.
• Compliance reporting – Audit logs and device enumeration provide data for compliance audits, demonstrating that password management follows defined policies.
• Impact of device deletion – Because the password is stored in the directory, deleting a device results in loss of the credential. A process must exist to capture passwords before decommissioning if they are required for forensic analysis.

Operational teams should also be aware of the following:

• Intune integration – For organizations already using Intune, the LAPS policy can be deployed as part of the endpoint security suite, leveraging existing compliance and configuration management pipelines.
• Group Policy – In hybrid environments, LAPS can be configured via GPO, but the policy must be linked to the appropriate OU and the client‑side settings must point to Microsoft Entra ID as the backup directory.
• Third‑party MDM – Devices that are co‑managed with Intune can also be managed by other MDM solutions, provided that the MDM can deploy the LAPS CSP settings.

Common Pitfalls

Several issues can arise during deployment if not properly addressed:

• Incorrect device type – Attempting to enable LAPS on Entra registered devices will fail, as the feature is unsupported.
• Missing RBAC permissions – Administrators without the password/read permission will receive access denied errors when trying to retrieve passwords.
• Policy misconfiguration – Forgetting to set BackUpDirectory to Microsoft Entra ID will cause passwords to be stored locally or not at all.
• Overlooking Conditional Access – If Conditional Access policies are applied to roles that do not support them (e.g., custom roles or administrative unit‑scoped roles), recovery attempts may be blocked unexpectedly.
• Loss of credential after device deletion – Without an external backup, the password for a deleted device cannot be recovered, which may be problematic for legacy systems.

Why this matters to enterprise IT

Enterprise IT environments typically manage hundreds or thousands of Windows endpoints, each with a local administrator account that can be exploited if compromised. The traditional approach of sharing a static password or storing it in a separate vault introduces risk and operational inefficiency. By integrating LAPS with Microsoft Entra ID, organizations can:

• Reduce attack surface – Randomly generated, frequently rotated passwords make credential theft and Pass‑the‑Hash attacks significantly harder.
• Centralize management – All local administrator passwords are stored in a single, cloud‑based directory, simplifying administration and audit.
• Enable zero‑trust access – Fine‑grained RBAC and Conditional Access ensure that only authorized personnel can retrieve passwords, and only under verified conditions.
• Support hybrid workloads – Whether devices are fully cloud‑joined or hybrid joined, LAPS provides a consistent mechanism for password management across the estate.
• Facilitate compliance – Built‑in audit logs and reporting capabilities help meet regulatory requirements for credential protection.

EBS consulting perspective

From an EBS consulting standpoint, the adoption of Windows LAPS with Microsoft Entra ID represents a strategic opportunity to modernize credential management within a zero‑trust framework. Our experience indicates that organizations often underestimate the complexity of aligning identity, device, and security policies. We recommend a phased approach that begins with a pilot group of devices, validates the integration with existing MDM and identity solutions, and then scales to the broader estate.

Key consulting considerations include:

• Architecture alignment – Ensure that the tenant’s device registration policy, RBAC model, and Conditional Access strategy are coherent and support the desired level of granularity.
• Integration with existing tooling – LAPS should be embedded into the organization’s endpoint management workflows, whether through Intune, System Center Configuration Manager, or third‑party MDM platforms.
• Change management – Administrators must be trained on the new retrieval process, the required permissions, and the audit expectations.
• Backup and disaster recovery – Establish a process for exporting LAPS passwords before device decommissioning, or integrate with a secure archival solution.

By treating LAPS not merely as a password rotation tool but as a component of a broader identity‑centric security architecture, enterprises can achieve measurable improvements in security posture and operational agility.

Practical next steps

1. Assess device inventory – Identify which Windows devices are eligible (Entra joined or hybrid joined) and confirm they meet the minimum OS version requirements.
2. Enable tenant‑wide LAPS – Use the Microsoft Entra admin center or Graph API to set the device registration policy to enable LAPS.
3. Define RBAC model – Determine which built‑in roles or custom roles will be used for password recovery, and assign them to appropriate groups.
4. Deploy client‑side policy – Create an Intune account protection policy or configure GPOs to set BackUpDirectory to Microsoft Entra ID and define password complexity rules.
5. Implement Conditional Access (if required) – Create policies that enforce MFA or device compliance for roles that can recover passwords.
6. Validate with pilot – Deploy the policy to a small group of devices, verify password generation, rotation, and retrieval, and review audit logs.
7. Scale and monitor – Expand deployment to the full fleet, set up monitoring for audit events, and establish a process for handling device decommissioning.

Following this roadmap will enable organizations to harness the full benefits of Windows LAPS within Microsoft Entra ID, reinforcing security, simplifying administration, and supporting a zero‑trust vision.

For enterprises seeking to accelerate their journey, EBS offers tailored consulting services that encompass architecture design, policy configuration, and operational handover, ensuring that LAPS is integrated seamlessly into the existing IT ecosystem.

EBS Consulting Advice

If your organization is evaluating Use Windows Local Administrator Password Solution (LAPS) with Microsoft Entra ID – Microsoft Entra ID, do not treat the technology decision in isolation. Start with the business outcome, current architecture, security and identity controls, operational constraints, migration dependencies and governance requirements. A practical assessment should identify the current-state gaps, prioritize the risks and define an implementation roadmap with measurable outcomes.

EBS can help assess the environment, develop the architecture and modernization roadmap, and translate the technical options into an actionable business plan. Relevant EBS services: Microsoft Azure consulting Escape Cloud Microsoft Solution Assessments.

Have a technology challenge? Email info@escapebusinesssolutions.com to describe your situation. We welcome questions, consulting discussions and requests for a proposal.