Windows LAPS with Entra ID Cloud Setup Guide

A single shared local administrator password deployed across an entire fleet of corporate laptops is one of the most dangerous vulnerabilities in modern SME infrastructure. If a remote worker clicks a sophisticated phishing link or downloads a malicious payload that extracts credentials from memory, an attacker gains local administrative access not just to that single endpoint, but to every workstation across the business. This shared-secret model enables effortless lateral movement across the internal corporate network and VPN connections.

For UK organisations pursuing or maintaining Cyber Essentials and Cyber Essentials Plus, shared local administrator accounts represent an immediate compliance roadblock. The National Cyber Security Centre (NCSC) device security guidance and IASME assessment standards strictly forbid shared administrative credentials and require least-privilege operation. Modern, cloud-native Windows Local Administrator Password Solution (Windows LAPS) solves this by integrating natively into Windows 11 and Windows 10, storing cryptographically random, device-unique passwords directly in Microsoft Entra ID and managing rotation policies through Microsoft Intune.

Quick answer

To deploy cloud-native Windows LAPS with Microsoft Intune and Microsoft Entra ID:

1. Enable the tenant-wide Microsoft Entra Local Administrator Password Solution (LAPS) toggle in the Microsoft Entra admin center under device settings.
2. In Microsoft Intune, create a new Account protection (Windows LAPS) policy under Endpoint security.
3. Choose whether to manage the built-in Administrator account or create and manage a designated custom local administrator username.
4. Set the Backup directory to Backup the password to Azure AD only (Microsoft Entra ID).
5. Configure password complexity (minimum 16 characters with uppercase, lowercase, numbers, and symbols) and a rotation age (such as 30 days).
6. Enable Post-authentication actions to automatically rotate the password and log off or reset the session after a support technician finishes work.
7. Assign the policy to all corporate-owned Windows devices and verify successful password escrow in the Entra ID device overview blade.

Who this affects

This setup is vital for IT directors, technical leads, and systems administrators managing hybrid or cloud-only UK SMEs. You should implement this immediately if:

• Your Windows endpoints are cloud-native and enrolled in Microsoft Entra ID (formerly Azure AD) without an on-premises Active Directory domain controller.
• You deploy Windows laptops through Windows Autopilot and currently run a custom PowerShell script or provisioning package to create a static local admin account.
• Your organisation is preparing for a Cyber Essentials Plus technical audit, where assessors actively verify that standard users lack local administrative rights and check password enforcement on local admin accounts.
• Your internal helpdesk relies on a shared spreadsheet, password manager entry, or sticky note containing a universal local admin password used during desktop troubleshooting.
• You have decommissioned legacy on-premises Active Directory and need a replacement for legacy domain-joined LAPS.

What usually goes wrong

Deploying cloud LAPS is straightforward, but subtle misconfigurations frequently prevent passwords from backing up to Entra ID.

What to check first

Before rolling out LAPS across your production fleet, run these targeted baseline checks across your tenant and a pilot workstation.

Evidence to collect

When preparing for Cyber Essentials Plus or internal governance audits, assemble this compliance evidence:

Fix path

Follow this step-by-step implementation guide to configure, deploy, and verify cloud-native Windows LAPS.

Step 1: Enable Windows LAPS in Microsoft Entra ID

Cloud LAPS requires an explicit tenant-level toggle before Entra ID will accept password backups from Windows endpoints:

1. Sign in to the Microsoft Entra admin center as a Global Administrator or Privileged Role Administrator.
2. Navigate to Identity > Devices > All devices > Device settings.
3. Locate the setting Enable Azure AD Local Administrator Password Solution (LAPS).
4. Toggle this setting to Yes.
5. Select Save at the top of the page.

Step 2: Establish your local administrator account strategy

Windows LAPS can manage either:

• The built-in Administrator account (SID -500). When targeted, Windows LAPS automatically enables this account if it is disabled.
• A custom administrator account name (for example, LocalAdmin-Mgt). If you specify a custom account name, that local account must already exist on the machine (created during provisioning via Intune script) or be provisioned alongside LAPS.

For most modern cloud-managed SME environments, managing the built-in Administrator account is the cleanest and most reliable method, as it avoids provisioning race conditions during Autopilot enrollment.

Step 3: Create the Windows LAPS policy in Microsoft Intune

1. Sign in to the Microsoft Intune admin center as an Intune Administrator or Endpoint Security Manager.
2. Navigate to Endpoint security > Account protection.
3. Select Create Policy.
4. Choose platform: Windows 10 and later.
5. Choose profile: Local admin password solution (Windows LAPS).
6. Select Create.

Step 4: Configure hardened policy settings

On the Configuration settings tab, configure the following baseline:

• Backup directory: Set to Backup the password to Azure AD only. This instructs the operating system to send rotated passwords to Microsoft Entra ID.
• Password Age Days: Set to 30 (or 14 if your industry compliance baseline requires fortnightly rotation).
• Administrator Account Name: Leave blank to manage the built-in Administrator account, or enter your exact custom username.
• Password Complexity: Select Large letters, small letters, numbers and special characters.
• Password Length: Set to 16 or 20 characters. Cyber Essentials requires robust password length for administrative accounts.
• Post Authentication Actions:
  • Action: Set to Reset the password and logoff the managed account. This guarantees that once a technician logs in with the LAPS password to resolve an issue, the password is automatically invalidated and rotated as soon as the session concludes.
  • Grace Period (Hours): Set to 8 or 12 hours, giving the support technician sufficient time to finish troubleshooting without the account locking mid-task.

Step 5: Assign and scope the policy

1. On the Assignments tab, target a device group such as All Corporate Windows Laptops or All Autopilot Devices.
2. Do not assign LAPS policies to user groups; LAPS is an endpoint-level configuration that applies to the device object.
3. Review and create the policy.

Step 6: Verify deployment on client endpoints

To verify that the client has received the policy and successfully generated and uploaded the password:

1. On a target Windows 11 or Windows 10 test machine, initiate a manual sync from Settings > Accounts > Access work or school > Info > Sync.
2. Open Event Viewer (eventvwr.msc).
3. Navigate to Applications and Services Logs > Microsoft > Windows > LAPS > Operational.
4. Check for the following key events:
   • Event ID 10015: LAPS policy processing started.
   • Event ID 10016: Local administrator password was updated locally.
   • Event ID 10017: Local administrator password was backed up to Microsoft Entra ID successfully.
   • Event ID 10020: LAPS post-authentication timer registered successfully.

Step 7: Retrieve the rotated password and review audit logs

When an IT technician needs to perform local maintenance on a machine disconnected from network connectivity:

1. In the Microsoft Entra admin center, navigate to Devices > All devices.
2. Select the specific device and click Local admin password.
3. Click Show local administrator password. The current plaintext password, expiration timestamp, and account name are displayed.
4. To view the historical audit trail, navigate to Entra ID > Monitoring > Audit logs. Filter by Activity: Recover device local administrator password. The log records precisely which administrator accessed the password, their IP address, and the exact timestamp.

Common mistakes

• Forgetting the tenant-level Entra toggle: Configuring the Intune policy without turning on the LAPS setting in Entra ID Device Settings results in local client event errors (0x80070005 or 0x80072ee2) indicating that the cloud directory refused the password payload.
• Assigning policies to user groups instead of device groups: Windows LAPS is an operating system service evaluating machine-level policies. Targeting user groups often leads to delayed application or inconsistent enforcement during device startup.
• Failing to configure post-authentication actions: If post-authentication reset is disabled, a password retrieved by an outsourced engineer remains valid for the remainder of the 30-day cycle, undermining the zero-trust principle.
• Permitting standard users to remain in the Administrators group: LAPS protects the dedicated local admin account, but it does not remove everyday employees from the Administrators group if they were enrolled with administrative privileges. Ensure your Autopilot profile enforces standard user roles.
• Granting over-broad helpdesk permissions to view LAPS passwords: In Entra ID, viewing LAPS passwords requires specific roles like Cloud Device Administrator or Intune Administrator. Use Entra Privileged Identity Management (PIM) to require time-bound elevation and business justification before technicians can view local admin credentials.

Related route

If your organisation needs help eliminating local administrator privileges, automating zero-touch Autopilot onboarding, or preparing endpoints for Cyber Essentials Plus certification, consult our Intune and Autopilot consultant service.

References

• Microsoft Learn: Windows LAPS overview
• NCSC: Device Security Guidance and Local Administration
• Microsoft Learn: Manage Windows LAPS with Microsoft Intune
• Microsoft Learn: Use Windows LAPS with Microsoft Entra ID