Deploying Windows LAPS with Intune: Pilot and Recovery Checks

Scope and Assumptions

This guide plans a Windows LAPS pilot managed through Intune, with passwords backed up to Microsoft Entra ID. It is reviewed against documentation, not a report of an executed rollout. Example commands collect evidence; the policy steps change devices and require an approved pilot.

The decision is more than password rotation: the support team must be able to retrieve a current credential, use it through an approved recovery path and demonstrate that it rotates afterwards. Keep an existing recovery path until all three checks pass.

Prerequisites

• Use a supported Windows release with Windows LAPS updates. Do not apply one Windows 11 KB number to Windows 10; verify the supported OS and update requirements in the Windows LAPS overview.
• Confirm Intune enrolment, licensing, policy permissions and reachable Microsoft endpoints.
• Establish whether the device is Entra joined or hybrid joined. Hybrid devices may back up to Entra ID or on-premises AD, not both. Entra registered devices are not supported for this scenario. Join-state restrictions.
• Inventory existing password managers and legacy LAPS policy. Do not allow two products to rotate the same account. Follow the legacy LAPS migration guidance before removing an existing agent or recovery path.
• Identify the managed local account, its enabled state and the support process. A policy targeting an account does not by itself establish that the account is usable.

Separate Policy Administration From Password Recovery

Creating a LAPS policy, enabling the tenant setting and reading a password are different permissions. Use the documented Intune role permissions for policy management and the Entra permissions for password recovery; do not assume all Intune administrators can read credentials. The Intune LAPS overview documents these requirements.

Assign credential access narrowly. Use a delegated role such as Cloud Device Administrator, or an appropriate custom role, with the intended device scope. Check actual authorisation with a support operator account before a rollout. Entra LAPS permissions and recovery.

Do not retrieve plaintext passwords merely to prove that escrow exists. Never place recovered passwords in screenshots, transcripts, CSV inventories or ordinary tickets.

Enable the Tenant Capability

In Entra device settings, an authorised administrator enables the Windows LAPS tenant setting. This permits the backup capability; it does not configure every device. Record the existing value and obtain tenant-change approval before changing it.

Do not switch this setting off to recover one failed pilot. That could affect password backup for unrelated devices.

Create a Narrow Intune Pilot

In Endpoint security > Account protection, create a Windows LAPS policy for the appropriate Windows platform. Use an assigned pilot device group first, rather than a dynamic rule that silently targets every managed device.

Decide the settings with the recovery owner:

Windows 11 24H2 and later offer additional automatic account-management capabilities; do not assume those exist on older clients. Check setting applicability in the LAPS policy reference and Intune deployment guidance.

For co-managed clients, review management authority and the effective policy on the device. Account protection is an Intune policy area, not a co-management workload slider. Check the supported workloads and eliminate overlapping LAPS configuration before widening scope.

Validate Policy and Escrow Separately

Trigger an approved Windows or Intune sync and inspect per-setting policy status. A successful profile report is not sufficient evidence of password backup.

On the pilot device, run this read-only example from an authorised elevated PowerShell session:

Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-LAPS/Operational'
    StartTime = (Get-Date).AddDays(-1)
} -ErrorAction Stop |
    Select-Object TimeCreated, Id, LevelDisplayName, Message

For directory backup, event 10029 records success to Entra ID; 10018 is success to Windows Server AD. Event 10005 signals policy-processing failure: use its error and surrounding events to diagnose the cause. These are not interchangeable with local password-change events. Microsoft LAPS event reference.

In the Intune or Entra device record, confirm the device identity and password backup timestamp. A missing pane can indicate permissions, platform applicability or absent backup, not just a display delay.

Password Retrieval Is a Separate Recovery Action

Use the portal recovery workflow only when the approved support scenario needs a credential. If using PowerShell, Microsoft's cmdlet is Get-LapsAADPassword with -DeviceIds, and it requires Microsoft Graph dependencies and an authorised connection. It queries Entra; it is not a local LAPS health command. See the cmdlet reference before choosing permissions or plaintext output.

Test one authorised recovery, then confirm the intended post-authentication action, subsequent backup timestamp and access audit. Record timestamps and outcomes, not secrets.

Troubleshooting and Failure Modes

Recovery and Rollback

1. Stop pilot expansion. Retain logs, assignment details and the current recovery owner.
2. If a policy setting is wrong, correct it within the pilot and verify effective device state and escrow again.
3. Before retiring LAPS management, establish and test the replacement credential-management and access process. Removing assignment does not restore a previous password.
4. Remove or revise only the pilot assignment through change control. Confirm resultant policy and account state; do not assume every setting reverts immediately.
5. If a credential was exposed, use the documented rotation action and verify a new backup. Deleting a device object or a portal “delete password” action is not a substitute for rotation.
6. Confirm unrelated devices continue backing up successfully. Preserve recovery access until the replacement passes validation.

Test it in a home lab (one Entra-joined VM)

Use this lab test on a personal Microsoft 365 developer tenant and a home Windows 11 VM. Do not use an employer or customer device.

Goal: prove three things on one device — policy delivered, password backed up to Entra, delegated retrieval and rotation afterwards.

1. Enable Windows LAPS in Entra ID > Devices > Device settings. Record the previous value.
2. Create an assigned device group that contains only the lab VM.
3. In Intune > Endpoint security > Account protection, create a Windows LAPS policy: backup directory Microsoft Entra ID, managed account you actually use, and a post-authentication action you can wait for.
4. Sync the VM. On the VM, collect LAPS operational events. Event 10029 is Entra backup success; 10005 is policy processing failure. See the LAPS event reference.
5. Confirm a backup timestamp on the Entra or Intune device record. A profile-success report is not that timestamp.
6. Retrieve the password with a delegated role that is not Global Administrator. Record the retrieval time, not the secret.
7. Use the credential through an approved recovery path, then confirm the post-authentication action and a new backup timestamp.

Related Reading

• BitLocker escrow diagnosis: distinguish encryption state from recoverability.
• Selected Windows hardening controls: resolve overlapping policies before enforcing a baseline.
• Intune and ConfigMgr decisions: plan policy ownership separately from provisioning.

Correction Record

19 September 2026: Added a one-device home-lab test.

10 September 2026: Corrected the sync and Graph examples and the password rollback steps. Corrected hybrid support, LAPS event IDs and the Account Protection policy path. Recovery now requires a verified replacement access path.