You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/devices/howto-manage-local-admin-passwords.md
+5-9Lines changed: 5 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,12 +1,12 @@
1
1
---
2
-
title: Use Windows Local Administrator Password Solution (LAPS) with Microsoft Entra ID (preview)
2
+
title: Use Windows Local Administrator Password Solution (LAPS) with Microsoft Entra ID
3
3
description: Manage your device's local administrator password with Microsoft Entra LAPS.
4
4
5
5
services: active-directory
6
6
ms.service: active-directory
7
7
ms.subservice: devices
8
8
ms.topic: how-to
9
-
ms.date: 04/21/2023
9
+
ms.date: 10/23/2023
10
10
11
11
ms.author: sandeo
12
12
author: sandeo-MSFT
@@ -15,11 +15,7 @@ ms.custom: references_regions
15
15
16
16
ms.collection: M365-identity-device-management
17
17
---
18
-
# Windows Local Administrator Password Solution in Microsoft Entra ID (preview)
19
-
20
-
> [!IMPORTANT]
21
-
> Microsoft Entra ID support for Windows Local Administrator Password Solution is currently in preview.
22
-
> For more information about previews, see [Universal License Terms For Online Services](https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all).
18
+
# Windows Local Administrator Password Solution in Microsoft Entra ID
23
19
24
20
Every Windows device comes with a built-in local administrator account that you must secure and protect to mitigate any Pass-the-Hash (PtH) and lateral traversal attacks. Many customers have been using our standalone, on-premises [Local Administrator Password Solution (LAPS)](https://www.microsoft.com/download/details.aspx?id=46899) product for local administrator password management of their domain joined Windows machines. With Microsoft Entra ID support for Windows LAPS, we're providing a consistent experience for both Microsoft Entra joined and Microsoft Entra hybrid joined devices.
25
21
@@ -77,7 +73,7 @@ LAPS is available to all customers with Microsoft Entra ID Free or higher licens
77
73
78
74
Other than the built-in Microsoft Entra roles of Cloud Device Administrator, Intune Administrator, and Global Administrator that are granted *device.LocalCredentials.Read.All*, you can use [Microsoft Entra custom roles](../roles/custom-create.md) or administrative units to authorize local administrator password recovery. For example,
79
75
80
-
- Custom roles must be assigned the *microsoft.directory/deviceLocalCredentials/password/read* permission to authorize local administrator password recovery. During the preview, you must create a custom role and grant permissions using the [Microsoft Graph API](../roles/custom-create.md#create-a-role-with-the-microsoft-graph-api) or [PowerShell](../roles/custom-create.md#create-a-role-using-powershell). Once you have created the custom role, you can assign it to users.
76
+
- Custom roles must be assigned the *microsoft.directory/deviceLocalCredentials/password/read* permission to authorize local administrator password recovery. You can create a custom role and grant permissions using the Microsoft Entra portal,[Microsoft Graph API](../roles/custom-create.md#create-a-role-with-the-microsoft-graph-api) or [PowerShell](../roles/custom-create.md#create-a-role-using-powershell). Once you have created the custom role, you can assign it to users.
81
77
82
78
- You can also create a Microsoft Entra ID [administrative unit](../roles/administrative-units.md), add devices, and assign the Cloud Device Administrator role scoped to the administrative unit to authorize local administrator password recovery.
83
79
@@ -119,7 +115,7 @@ You can also use Microsoft Graph API [Get deviceLocalCredentialInfo](/graph/api/
119
115
120
116
## List all Windows LAPS enable devices
121
117
122
-
To list all Windows LAPS enabled devices, you can browse to **Identity** > **Devices** > **Overview** > **Local administrator password recovery (Preview)** or use the Microsoft Graph API.
118
+
To list all Windows LAPS enabled devices, you can browse to **Identity** > **Devices** > **Overview** > **Local administrator password recovery** or use the Microsoft Graph API.
123
119
124
120
## Auditing local administrator password update and recovery
0 commit comments