Skip to content

Commit b639c38

Browse files
Merge pull request #255898 from SanDeo-MSFT/patch-116
Update howto-manage-local-admin-passwords.md
2 parents f6b961b + 7036615 commit b639c38

File tree

1 file changed

+5
-9
lines changed

1 file changed

+5
-9
lines changed

articles/active-directory/devices/howto-manage-local-admin-passwords.md

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
---
2-
title: Use Windows Local Administrator Password Solution (LAPS) with Microsoft Entra ID (preview)
2+
title: Use Windows Local Administrator Password Solution (LAPS) with Microsoft Entra ID
33
description: Manage your device's local administrator password with Microsoft Entra LAPS.
44

55
services: active-directory
66
ms.service: active-directory
77
ms.subservice: devices
88
ms.topic: how-to
9-
ms.date: 04/21/2023
9+
ms.date: 10/23/2023
1010

1111
ms.author: sandeo
1212
author: sandeo-MSFT
@@ -15,11 +15,7 @@ ms.custom: references_regions
1515

1616
ms.collection: M365-identity-device-management
1717
---
18-
# Windows Local Administrator Password Solution in Microsoft Entra ID (preview)
19-
20-
> [!IMPORTANT]
21-
> Microsoft Entra ID support for Windows Local Administrator Password Solution is currently in preview.
22-
> For more information about previews, see [Universal License Terms For Online Services](https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all).
18+
# Windows Local Administrator Password Solution in Microsoft Entra ID
2319

2420
Every Windows device comes with a built-in local administrator account that you must secure and protect to mitigate any Pass-the-Hash (PtH) and lateral traversal attacks. Many customers have been using our standalone, on-premises [Local Administrator Password Solution (LAPS)](https://www.microsoft.com/download/details.aspx?id=46899) product for local administrator password management of their domain joined Windows machines. With Microsoft Entra ID support for Windows LAPS, we're providing a consistent experience for both Microsoft Entra joined and Microsoft Entra hybrid joined devices.
2521

@@ -77,7 +73,7 @@ LAPS is available to all customers with Microsoft Entra ID Free or higher licens
7773

7874
Other than the built-in Microsoft Entra roles of Cloud Device Administrator, Intune Administrator, and Global Administrator that are granted *device.LocalCredentials.Read.All*, you can use [Microsoft Entra custom roles](../roles/custom-create.md) or administrative units to authorize local administrator password recovery. For example,
7975

80-
- Custom roles must be assigned the *microsoft.directory/deviceLocalCredentials/password/read* permission to authorize local administrator password recovery. During the preview, you must create a custom role and grant permissions using the [Microsoft Graph API](../roles/custom-create.md#create-a-role-with-the-microsoft-graph-api) or [PowerShell](../roles/custom-create.md#create-a-role-using-powershell). Once you have created the custom role, you can assign it to users.
76+
- Custom roles must be assigned the *microsoft.directory/deviceLocalCredentials/password/read* permission to authorize local administrator password recovery. You can create a custom role and grant permissions using the Microsoft Entra portal, [Microsoft Graph API](../roles/custom-create.md#create-a-role-with-the-microsoft-graph-api) or [PowerShell](../roles/custom-create.md#create-a-role-using-powershell). Once you have created the custom role, you can assign it to users.
8177

8278
- You can also create a Microsoft Entra ID [administrative unit](../roles/administrative-units.md), add devices, and assign the Cloud Device Administrator role scoped to the administrative unit to authorize local administrator password recovery.
8379

@@ -119,7 +115,7 @@ You can also use Microsoft Graph API [Get deviceLocalCredentialInfo](/graph/api/
119115

120116
## List all Windows LAPS enable devices
121117

122-
To list all Windows LAPS enabled devices, you can browse to **Identity** > **Devices** > **Overview** > **Local administrator password recovery (Preview)** or use the Microsoft Graph API.
118+
To list all Windows LAPS enabled devices, you can browse to **Identity** > **Devices** > **Overview** > **Local administrator password recovery** or use the Microsoft Graph API.
123119

124120
## Auditing local administrator password update and recovery
125121

0 commit comments

Comments
 (0)