What this check looks at
Checks that Entra ID’s Local Administrator Password Solution (LAPS) setting is on, so Windows devices can rotate and back up their local administrator password.
Every Windows device has a local administrator account, and the classic problem is that its password is the same on every machine, set once in an image or build script and never changed. Windows LAPS gives each device its own random local administrator password, rotates it on a schedule and backs it up to Microsoft Entra ID, where only authorised administrators can read it.
For Entra-joined devices LAPS needs two things: the tenant switch Enable Microsoft Entra Local Administrator Password Solution (LAPS) in the device settings, and an Intune (or Group Policy) LAPS policy telling devices to manage the password. This check reads the tenant switch. It fails when the switch is off, because no device can back up its password to Entra ID until it is on, and passes when it is on.
With a shared local administrator password, one compromised laptop gives an attacker the key to every other device: they extract the local account’s password hash and reuse it to sign in elsewhere on the network. A password written into a build document, or known to former IT staff, is just as bad.
Why it matters
Without LAPS, local administrator passwords are often the same on every machine, so one compromised laptop gives an attacker the password to all of them. LAPS gives each device its own, rotated password held in Entra ID.
Moving sideways with a shared local admin password is a standard step in ransomware attacks on small networks: from one infected laptop to the file server and every other PC within minutes. With LAPS, the password from one machine opens nothing else, which slows the attacker and contains the damage.
LAPS also helps the service desk. When an engineer needs local admin rights on a device, they read that device’s current password from Entra ID or Intune, use it, and it rotates afterwards. No shared password has to live in a spreadsheet or a password manager that half the team can see.
The CIS Microsoft 365 Foundations Benchmark (5.1.4.5) asks for Entra LAPS to be enabled, and Cyber Essentials requires default and shared passwords to be changed and administrative access to be controlled. The rule maps to NIST CSF 2.0 PR.AA-01.
How to fix it
Where: Entra admin centre → Devices → Device settings
Before you start
- Turning the tenant setting on changes nothing on devices by itself; plan the Intune LAPS policy that rotates and backs up the password.
Step by step
- Turn on LAPS in Entra ID. In the Microsoft Entra admin centre, go to Entra ID > Devices > Device settings. Set Enable Microsoft Entra Local Administrator Password Solution (LAPS) to Yes and select Save. This alone changes nothing on devices.
- Create the Intune LAPS policy. In the Microsoft Intune admin centre, go to Endpoint security > Account protection > Create policy, with Platform Windows and Profile Local admin password solution (Windows LAPS). Set Backup Directory to the option that backs the password up to Microsoft Entra ID only, Password Age Days to 30, and a password length of at least 14 characters. If devices use a custom local admin account rather than the built-in one, enter its name under Administrator Account Name.
- Assign it to a pilot group, then all Windows devices. Assign the policy to a small group of devices first and, once it works, to all Windows devices. Devices need a supported Windows 10 or 11 build that includes Windows LAPS (the April 2023 updates or later).
- Check the password is backed up. Once the pilot devices have synced, go to Entra ID > Devices > Local administrator password recovery, or open a device in Entra ID > Devices > All devices and show its local administrator password. The password and its next rotation time should appear.
- Check who can read the passwords. Reading a LAPS password needs a role such as Cloud Device Administrator, Intune Administrator or Global Administrator, or a custom role with the device local credential permission. Make sure only the support team holds one, and that reads appear in Entra ID > Monitoring & health > Audit logs.
- Retire the old shared password. Once LAPS has rotated the password on every device, remove the old shared password from documentation and password managers, and stop using it in build scripts.
- Confirm. Reload Device settings and check LAPS shows Yes; Local administrator password recovery lists devices with backed-up passwords. Re-run the assessment to confirm the finding passes.
What users will notice
None. Once the Intune policy applies, each device’s local administrator password is rotated and readable only by authorised admins.
How to confirm it worked
Entra admin centre, Devices, Device settings: "Enable Microsoft Entra Local Administrator Password Solution (LAPS)" is Yes; Devices, Local administrator password recovery lists devices after the policy applies.
Frameworks and controls
This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.c Privileged user management |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | IM-8 Restrict the exposure of credentials and secrets |
| Zero Trust | Endpoints |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| PCI DSS 4.0.1 | 2.2.2 Vendor default accounts are managed |
| NIST SP 800-171 | 3.5.2 Authenticate users, processes and devices |
| CMMC Level 2 | IA.L2-3.5.2 Authentication |
| ISO 27001:2022 | A.8.2 Privileged access rightsA.5.17 Authentication information |
| CIS M365 | 5.1.4.5 Ensure Local Administrator Password Solution is enabled |
| CIS Controls v8.1 | 5.2 Use unique passwords (IG1) |
| NIST CSF 2.0 | PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Windows LAPS with Microsoft Entra ID (Microsoft Learn)