🏗️ Architecture: How Intune, the LAPS CSP, and Entra ID Connect

Three layers work in sequence. Understanding where each one sits determines where to look when something fails.

🔐 Prerequisites and RBAC Before You Touch a Policy

Three distinct actions require three distinct permission sets. Confirm which accounts hold which permissions before starting.

License baseline: LAPS itself requires only Microsoft Entra ID Free or higher. Administrative units, custom Entra roles, and Conditional Access on LAPS recovery each carry additional licensing requirements not enumerated here. Verify those against current Entra licensing documentation before scoping the RBAC model.

OS requirement: Windows 11 21H2/22H2, Windows 10 20H2/21H2/22H2, Windows Server 2019/2022, all with the April 11, 2023 update or later. Microsoft Entra registered devices are not supported; Entra joined and Entra hybrid joined devices are.

🎯 Step 1 — Enable LAPS at the Entra Tenant Level

This is a hard prerequisite. No device can back a password to Entra ID until this switch is on, regardless of what the Intune policy says.

1. Sign in to the Microsoft Entra admin center as at least a Cloud Device Administrator.
2. Browse to Entra ID > Devices > Overview > Device settings.
3. Set Enable Local Administrator Password Solution (LAPS) to Yes.
4. Select Save.

🛠️ Step 2 — Create the Intune LAPS Policy

1. Sign in to the Microsoft Intune admin center.
2. Go to Endpoint security > Account protection and select Create Policy.
3. Set Platform to Windows and Profile to Local admin password solution (Windows LAPS). Select Create.
4. On Basics, enter a name that identifies the target scope (for example, LAPS-EntraJoined-Production). A description is optional but worth adding, because policy names are the primary way to distinguish configurations at scale.
5. On Configuration settings, set Backup Directory to Microsoft Entra ID. This is the setting that determines where the password is stored. See the architecture note below before choosing.
6. Configure Administrator Account Name if you want to target a specific account. Leave it blank only if you intend to manage the built-in local admin account, identified by its well-known RID. Read the design guidance in the next section before accepting the default.
7. Set remaining password settings (age, length, complexity, post-authentication actions) to meet your organization's requirements. The documentation notes that the policy setting values shown in events 10021, 10022, and 10023 are examples and should not be treated as recommendations.
8. On Scope tags, apply any tags your environment requires.
9. On Assignments, add your device groups. Do not assign to user groups at this stage. Read Step 3 first.
10. On Review + create, confirm settings and select Create.

🧩 The Backup Directory and Account Name Decision

These two settings determine what LAPS actually manages. Getting either one wrong produces a result that looks correct in Intune but accomplishes nothing useful on the device.

Backup Directory is the more consequential of the two. For Entra-joined devices, the only viable choice is Microsoft Entra ID. Active Directory requires domain join. Setting the wrong value does not cause a policy error. The CSP applies the settings, the Intune admin center shows the policy as successful, and the backup never happens. The only place this mismatch is visible is the LAPS event log on the device itself (My read of the event log sequence: if 10022 shows the correct CSP source and Backup directory but 10029 never appears in the same cycle, the backup did not complete).

Administrator Account Name controls which account LAPS manages. When left blank, LAPS defaults to the built-in local administrator account identified by its well-known RID, not by name. That matters if the built-in account has been renamed by another policy or was disabled at provisioning time. If the account name specified in the policy does not exist on the device, LAPS manages nothing and backs up nothing. The documentation is explicit on this point: no account is managed when the specified name is absent.

When the account name is changed mid-deployment, the original account loses LAPS management immediately. The new account becomes the managed account, and details about the previous account are no longer available in the admin center or in Entra ID. There is no transition period.

📋 Step 3 — Assign to Device Groups, Not User Groups

The documentation recommends assigning LAPS policy to device groups. The reason is architectural, not administrative preference.

LAPS manages one local admin account per device. The CSP supports a single configuration per setting. When the policy is assigned to a user group, a different policy can apply each time a different user signs in to the device. Each new policy application can change which account is managed, reset the rotation schedule, or introduce a conflicting configuration with a second LAPS policy that already reached the device through a different assignment. The documented consequence is that both policies report as conflicting, settings are not sent to the device, and no backup completes.

If your current Intune group structure assigns most endpoint policies to user groups for operational consistency, LAPS is the exception. Create a device group for your Entra-joined endpoints and target LAPS there.

✅ Step 4 — Validate the Password Backup

Policy assignment is not validation. The Intune console reporting a policy as assigned confirms delivery intent, not that the device has checked in, processed the settings, and successfully backed up a credential to Entra ID. Validate the full chain.

Check 1: Confirm the device has checked in and processed the policy

1. In the Intune admin center, go to Devices > All devices and select the target device.
2. Under Device configuration, confirm the LAPS profile shows a status of Succeeded, not Pending or Error.
3. If the status is Pending, the device has not yet checked in. Wait for the next check-in cycle or trigger a sync before continuing.

Check 2: Confirm the password backup in the admin center

1. From the device Overview pane, under Monitor, select Local admin password.
2. Confirm the following fields are populated:

- Account name: the name of the managed local admin account - Security ID — the well-known SID for that account - Last password rotation — a UTC timestamp indicating the last rotation - Next password rotation — a UTC timestamp indicating when the next rotation is scheduled

Check 3 — Confirm the password is retrievable

Select Show next to Local admin password. If your account holds microsoft.directory/deviceLocalCredentials/password/read, the password is revealed. If the Show button is absent or disabled, your account has only standard/read — you can see the metadata but not the password. Retrieving the password triggers an Entra audit event.

Check 4 — Validate on the device event log

On the managed device, open Event Viewer and navigate to Applications and Services > Logs > Microsoft > Windows > LAPS > Operational. Confirm the following sequence appears:

• Event 10003 — policy processing started
• Event 10022 — policy configuration logged with Policy source: CSP and Backup directory: Azure AD
• Event 10029 — LAPS successfully updated Azure Active Directory with the new password
• Event 10020 — LAPS successfully updated the local admin account with the new password
• Event 10004 — policy processing succeeded

If 10029 is absent from a completed cycle (10003 followed by 10004), the backup did not complete. The Backup Directory mismatch described in Step 2 is the first thing to check.

🔄 Step 5 — Rotate the Password Manually

Manual rotation runs independently of the scheduled rotation. Use it when you need to invalidate a password that may have been exposed, after a helpdesk session, or before decommissioning a device.

Permissions required: Managed devices: Read + Organization: Read + Remote tasks: Rotate Local Admin Password.

To rotate:

1. In the Intune admin center, go to Devices > All devices and select the target device.
2. Expand the ellipsis (...) in the menu bar and select Rotate Local admin password.
3. Confirm the action when prompted. The rotation takes a few minutes.
4. Monitor Device actions status on the device Overview pane. The action moves from Pending to Complete when successful.

Documented constraints — read these before rotating:

• The device must be online at the time the rotation is requested. If offline, the action shows Pending and then fails. There is no automatic retry. You must re-initiate after the device is online.
• Rotation is not a bulk action. One device at a time.
• Each manual rotation resets the PasswordAgeDays counter from the rotation date, not from the original policy application date. If the policy sets 10-day rotation and you manually rotate on day 5, the next scheduled rotation is 10 days from the manual rotation date, not from the original date. The documentation illustrates this with a specific example: a March 1 policy with a 10-day schedule, manually rotated on March 5, produces a next automatic rotation on March 15.
• Every manual rotation generates an audit event. So does every scheduled rotation.

📊 Understanding the LAPS Event Log

The LAPS event log is on the device. Navigate to Applications and Services > Logs > Microsoft > Windows > LAPS > Operational in Windows Event Viewer. Every policy processing cycle produces a sequence of events. The table below maps the documented events to their meaning and the action to take when each appears.

🔍 Troubleshooting: What to Check When LAPS Is Silent

Silent LAPS means one of a small set of things. Work through them in order.

The tenant toggle is off. Every other step can be correct, and nothing backs up if the Entra Device settings page shows LAPS as disabled. Check this first, before looking at policy configuration or event logs. The toggle is in Entra ID > Devices > Overview > Device settings.

The device has not checked in yet. After policy assignment, the Local admin password pane shows no data until the device processes the policy. This state is indistinguishable from a misconfiguration until the device checks in. Confirm check-in status in the Intune admin center and, if necessary, initiate a manual sync before concluding the policy failed.

The Backup Directory setting does not match the device join type. This is the most operationally deceptive failure. The CSP settings apply. The Intune policy shows Succeeded. The device event log shows a 10004 (cycle complete). But event 10029 never appears because the device tried to back up to Active Directory on a machine that is not domain joined. Look at event 10022 in the device log — specifically the Backup directory: field. If it shows Active Directory instead of Azure AD, the policy has the wrong setting.

The named account does not exist on the device. If Administrator Account Name specifies an account that is not present on the device, LAPS does not manage any account. The cycle may complete without error, but no account is backed up. Verify that the specified account exists on the device before concluding that the policy is misconfigured. If the account was created by a separate Intune policy, check that the account creation policy ran before the LAPS policy applied.

Multiple LAPS policies reached the same device. The Windows LAPS CSP supports one configuration per setting. When two policies conflict, neither applies. Both policies report as conflicting in Intune. On the device, the policy processing cycle may end with a 10005 event. Check the error code and the intervening events for detail. The resolution is to reduce the policies reaching the device to one, either by removing overlapping group assignments or by consolidating the conflicting settings into a single policy. The documentation is specific: while a conflict remains, no LAPS settings are sent to the device.

The device was offline when manual rotation was requested. The Device actions status will show Pending and eventually Failed. There is no automatic retry. Once the device is online, an administrator must re-initiate the rotation from the Intune admin center.

RBAC prevents the helpdesk from seeing what they need. If the Local admin password pane appears but the Show button is absent, the account has metadata read permissions but not password read permissions. Assign microsoft.directory/deviceLocalCredentials/password/read through the Cloud Device Administrator role or a custom Entra role with P1/P2.

When a device is deleted from Entra ID, the LAPS credential stored against that device object is permanently lost. The documentation states explicitly that there is no recovery path within Entra ID for a deleted device's LAPS password. If your environment provisions devices frequently and decommissions them, ensure that any needed credentials are retrieved before device deletion.

📋 Programmatic Access: Graph API and Audit Log Queries

For SOC teams that need to retrieve passwords without the admin center, or to audit which accounts have been accessed, the Microsoft Graph API exposes the same data.

Retrieve the LAPS credential for a specific device (requires DeviceLocalCredential.Read.All):

GET https://graph.microsoft.com/v1.0/deviceLocalCredentials/{deviceId}?$select=credentials

The password value returned by the API is Base64 encoded. Decode it before use. The documentation states this explicitly.

Retrieve LAPS-related audit events from Entra ID using PowerShell and the Microsoft Graph SDK. This retrieves Recover device local administrator password events for SOC review:

Connect-MgGraph -Scopes "AuditLog.Read.All"

Get-MgAuditLogDirectoryAudit -Filter "activityDisplayName eq 'Recover device local administrator password'" |
    Select-Object ActivityDateTime, InitiatedBy, TargetResources, Result |
    Sort-Object ActivityDateTime -Descending

The Entra audit log also captures Update device local administrator password events, which represent password rotation. To review both:

Get-MgAuditLogDirectoryAudit -Filter "activityDisplayName eq 'Update device local administrator password' or activityDisplayName eq 'Recover device local administrator password'" |
    Select-Object ActivityDateTime, ActivityDisplayName, InitiatedBy, TargetResources, Result |
    Sort-Object ActivityDateTime -Descending

⚠️ What This Guide Does Not Cover

This guide covers Entra-joined devices managed through Intune with the Backup Directory set to Microsoft Entra ID. Three adjacent scenarios are out of scope here.

Entra hybrid joined devices with Active Directory backup. The configuration path is different. The Backup Directory is set to Active Directory, the policy processing produces event 10021 instead of 10022, and password retrieval goes through AD tooling rather than the Entra admin center. The documentation for that path is at Configure Windows LAPS for Windows Server Active Directory.

Conditional Access policies scoped to LAPS password recovery. Entra supports Conditional Access on the built-in roles (such as Cloud Device Administrator) that hold password recovery rights — for example, requiring MFA before a password can be retrieved. The documentation covers this at Common Conditional Access policy: Require MFA for administrators. Conditional Access cannot be scoped to administrative unit-scoped roles or custom roles for this purpose.

macOS LAPS in Intune. The Intune support for macOS local account configuration with LAPS is a distinct implementation. The documentation note in the source is clear: similar but distinct. The macOS path is not covered here.