Skip to content

Commit e120054

Browse files
SanDeo-MSFTSanDeo-MSFT
authored
Create howto-windows-laps-with-azuread.md
1 parent 4db82b2 commit e120054

File tree

1 file changed

+194
-0
lines changed

1 file changed

+194
-0
lines changed

‎articles/active-directory/devices/howto-windows-laps-with-azuread.md

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
---
2+
title: How to use Windows Local Administrator Password Solution (LAPS) with Azure AD (preview)
3+
description: Use Windows Local Administrator Password Solution to keep your Windows devices in Azure AD secure.
4+
5+
services: active-directory
6+
ms.service: active-directory
7+
ms.subservice: devices
8+
ms.topic: how-to
9+
ms.date: 04/20/2023
10+
11+
ms.author: sandeo
12+
author: sandeo-MSFT
13+
ms.reviewer: joflore
14+
15+
#Customer intent: As an IT admin, I want to deploy Windows Local Administartor Password Solutiin for Windows devices that are joined to Azure AD
16+
17+
ms.collection: M365-identity-device-management
18+
---
19+
20+
# Azure AD support for Windows LAPS (preview)
21+
22+
> [!IMPORTANT]
23+
> Azure AD support for Windows LAPS is currently in PREVIEW.
24+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
25+
26+
Every Windows device comes with a built-in local administrator account that you must secure and protect to mitigate any Pass-the-Hash (PtH) and lateral traversal attacks. Many customers have been using our standalone, on-premises [LAPS](https://www.microsoft.com/download/details.aspx?id=46899) product for local administrator password management of their domain joined Windows machines. With Azure AD support for Windows LAPS, we are providing a consistent experience for both Azure AD joined and hybrid Azure AD joined devices.
27+
28+
Azure AD support for LAPS includes the following capabilities:
29+
30+
- **Enabling Windows LAPS with Azure AD** - Enable a tenant wide policy and a client-side policy to backup local administrator password to Azure AD.
31+
- **Local administrator password management** - Configure client-side policies to set account name, password age, length, complexity, manual password reset and so on.
32+
- **Recovering local administrator password** - Use API/Portal eperiences for local administrator password recovery.
33+
- **Enumerating all Windows LAPS enabled devices** - Use API/Portal eperiences to enumerate all Windows devices in Azure AD enabled with Windows LAPS.
34+
- **Authorization of local administrator password recovery** - Use role based access control (RBAC) policies with custom roles and administrative units.
35+
- **Auditing local administrator password update and recovery** - Use audit logs API/Portal experinces to monitor password update and recovery events.
36+
- **Conditional Access policies for local administrator password recovery** - Configure Conditional Access policies on directory roles that have the authorization of password recovery.
37+
38+
> [!NOTE]
39+
> Devices that are workplace-joined (WPJ) are not supported by Intune for LAPS.
40+
41+
To learn about Windows LAPS in more detail, start with the following articles in the Windows documentation:
42+
43+
- [What is Windows LAPS?](https://learn.microsoft.com/windows-server/identity/laps/laps-scenarios-azure-active-directory) – Introduction to Windows LAPS and the Windows LAPS documentation set.
44+
- [Windows LAPS CSP](https://learn.microsoft.com/windows/client-management/mdm/laps-csp) – View the full details for LAPS settings and options. Intune policy for LAPS uses these settings to configure the LAPS CSP on devices.
45+
- [Microsoft Intune support for Windows LAPS](https://learn.microsoft.com/mem/intune/protect/windows-laps-overview)
46+
47+
## Requirements
48+
49+
### Supported Azure regions and Windows distributions
50+
51+
This feature is now available in the following Azure clouds:
52+
53+
- Azure Global
54+
- Azure Government
55+
- Azure China 21Vianet
56+
57+
This feature is now available on the following Windows OS platforms with the specified update or later installed:
58+
59+
- [Windows 11 22H2 - April 11 2023 Update](https://support.microsoft.com/help/5025239)
60+
- [Windows 11 21H2 - April 11 2023 Update](https://support.microsoft.com/help/5025224)
61+
- [Windows 10 20H2, 21H2 and 22H2 - April 11 2023 Update](https://support.microsoft.com/help/5025221)
62+
- [Windows Server 2022 - April 11 2023 Update](https://support.microsoft.com/help/5025230)
63+
- [Windows Server 2019 - April 11 2023 Update](https://support.microsoft.com/help/5025229)
64+
65+
## Enabling Windows LAPS with Azure AD
66+
67+
To enable Windows LAPS with Azure AD, you must:
68+
69+
1. In the **Azure AD Devices** menu, select **Device settings**, and then select **Yes** for Enable Local Administartor Password Solution (LAPS) setting and click **Save**. You also have the option to use MS Graph API [Update deviceRegistrationPolicy](https://learn.microsoft.com/graph/api/deviceregistrationpolicy-update?view=graph-rest-beta).
70+
2. Configure client-side policy and set **BackUpDirectory** to be Azure AD.
71+
- If you are using Microsoft Intune to manage client side policies, see [Manage Windows LAPS using Microsoft Intune](https://learn.microsoft.com/mem/intune/protect/windows-laps-policy)
72+
- If you are using Group Policy Objects (GPO) to manage client side policies, see [Windows LAPS Group Policy](https://learn.microsoft.com/windows-server/identity/laps/laps-management-policy-settings#windows-laps-group-policy)
73+
74+
> [!NOTE]
75+
> The preferred option to configure Windows LAPS policy for Azure AD joined devices is to use [Manage Windows LAPS using Microsoft Intune](https://learn.microsoft.com/mem/intune/protect/windows-laps-policy). However, if your devices are Azure AD joined but you're not using Microsoft Intune or Microsoft Intune is not supported (e.g. Windows Server 2019/2022), you can still deploy Windows LAPS for Azure AD. In this scenario, you must deploy policy manually (for example, either by using direct registry modification or by using Local Computer Group Policy). For more information, see [Configure Windows LAPS policy settings](https://learn.microsoft.com/windows-server/identity/laps/laps-management-policy-settings).
76+
77+
## LAPS password management
78+
To configure LAPS password management policies for your Azure AD joined devices, you can use Microsoft Intune or any other MDM provider of your choide. If you are using Microsoft Intune to manage client side policies, see [Manage Windows LAPS using Microsoft Intune](https://learn.microsoft.com/mem/intune/protect/windows-laps-policy)
79+
To configure LAPS password management for your hybrid Azure AD joined devices, you can use GPO if such devices are not [co-managed](https://learn.microsoft.com/mem/configmgr/comanage/overview) with Microsoft Intune. If you are using GPO, see [Windows LAPS Group Policy](https://learn.microsoft.com/windows-server/identity/laps/laps-management-policy-settings#windows-laps-group-policy).
80+
81+
## Recovering local administrator password
82+
To view local administrator password for a Windows device joined to Azure AD, you need to be garnted the *deviceLocalCredentials.Read.All* permission and you must be assigned one of the following roles:
83+
84+
- Global Administrator
85+
- Cloud Device Administrator
86+
- Intune Service Administrator
87+
88+
You can also use MS Graph API [Get deviceLocalCredentialInfo](https://learn.microsoft.com/en-us/graph/api/devicelocalcredentialinfo-get?view=graph-rest-beta) to recover local administrative password. If you use the MS Graph API, the password returned is in Base64 encoded value that you will need to decode before using it.
89+
90+
## Enumerating all Windows LAPS enable devices
91+
92+
To enumerate all Windows LAPS enabled devices with Azure AD, you can use Azure AD portal by going to **Azure AD Devices | Overview** page and selecting **Local administrator password recovery (Preview)** menu.
93+
94+
You can also use MS Graph API to list all devices in Azure AD enbled with Windows LAPS.
95+
96+
## Authorization of local administrator password recovery
97+
Other than the built-in Azure AD roles of Global Administrator, Cloud Device Administrator and Intune Administrator that are granted *device.LocalCredentials.Read.All*, you can use Azure AD custom roles or administrative units to authorize local administrator password recovery. For example,
98+
99+
- **You want to allow users other than Global Administrator, Cloud Device Administrator or Intune Administrator to have access to local administrator password account**
100+
101+
You can create an Azure AD [custom role](https://learn.microsoft.com/azure/active-directory/roles/custom-create), you need to assign *microsoft.directory/deviceLocalCredentials/password/read* permission to authorize local administrator password recovery.
102+
103+
> [!NOTE]
104+
> Since Microsoft Entra portal is not yet enabled to show permissions for LAPS, you will need to create a custom role and grant permissions using [MS Graph API](https://learn.microsoft.com/azure/active-directory/roles/custom-create#create-a-role-with-the-microsoft-graph-api) or [Powershell](https://learn.microsoft.com/azure/active-directory/roles/custom-create#create-a-role-using-powershell)
105+
106+
Once you have created the custom role, you can assign it to users using Microsoft Entra portal, MS Graph API or Powershell.
107+
108+
- **You want to allow users other than Global Administrator, Cloud Device Administrator or Intune Administrator to have access to local administrator password account to specific set of devices**
109+
110+
You can also create an Azure AD [administrative unit](https://learn.microsoft.com/azure/active-directory/roles/administrative-units), add devices and assign Cloud Device Administrator role with administrative unit scope to authorize local administrator password recovery.
111+
112+
> [!NOTE]
113+
> Since Microsoft Entra portal is not yet enabled to assign custom role (you would create to authorize local administartor password recovery) with administrative unit, you will need to use [MS Graph API](https://learn.microsoft.com/azure/active-directory/roles/admin-units-manage#microsoft-graph-api) or [Powershell](https://learn.microsoft.com/azure/active-directory/roles/admin-units-manage#microsoft-graph-powershell)
114+
115+
## Auditing local administrator password update and recovery
116+
To view audit events for local adminsitartor password update, you can go to **Azure AD Devices | Overview** page, select **Audit** logs, then use **Activity** filter and Search for **Update device local administrator password** to view the audit events.
117+
118+
To view audit events for local adminsitartor password recovery, you can go to **Azure AD Devices | Overview** page, select **Audit** logs, then use **Activity** filter and Search for **Recover device local administrator password** to view the audit events.
119+
120+
## Conditional Access policies for local administrator password recovery
121+
To configure Conditional Access for local administartor passwrod recovery you will need to assign policy with user scope to built-in roles such as Global Administrator, Cloud Device Administrator and Intune Administrator that when granted *deviceLocalCredential.Read.All* permission have the ability to recover local administrator password for any Windows device joined to Azure AD and enabled with Windows LAPS. You can find more details on [Conditional Access USer Assignments](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-users-groups)
122+
123+
> [!NOTE]
124+
> Other role types including administrative unit-scoped roles and custom roles aren't supported
125+
126+
You can use Azure AD to enable LAPS Microsoft Intune endpoint security policies for [account protection](../protect/endpoint-security-account-protection-policy.md) to manage LAPS on devices that have enrolled with Intune. Intune policies can:
127+
128+
**Licensing requirements**:
129+
130+
- **Azure Active Directory subscription**
131+
*Azure Active Directory Free*, when you are using basic Windows LAPS with Microsoft Entra (Azure AD) features such as enabling LAPS using device settings, storing encrypted local administrator password, password recovery and audit logsis the free version of Azure AD that’s included when you subscribe to Intune. With Azure AD Free, you can use all the features of LAPS.
132+
*Azure Active Directory Premium*, when you are using premium experiences to improve security with capabilities such as Conditional Access, Custom Roles and Administrative Units
133+
- **Intune subscription**
134+
*Microsoft Intune Plan 1*, which is the basic Intune subscription. You can also use Windows LAPS with a free trial subscription for Intune.
135+
136+
137+
For information about Windows LAPS architecture, see [Key concepts in Windows LAPS](/windows-server/identity/laps/laps-concepts#windows-laps-architecture) in the Windows documentation.
138+
139+
## Frequently Asked Questions
140+
141+
### Is Windows LAPS supported on non Windows platforms?
142+
143+
No.
144+
145+
### Is Windows LAPS with Azure AD supported for Azure AD registered (aka Workplace Join) devices?
146+
147+
No.
148+
149+
### Which Windows OS platforms is Windows LAPS supported on?
150+
151+
Windows LAPS is now available on the following Windows OS platforms with the specified update or later installed:
152+
153+
- [Windows 11 22H2 - April 11 2023 Update](https://support.microsoft.com/help/5025239)
154+
- [Windows 11 21H2 - April 11 2023 Update](https://support.microsoft.com/help/5025224)
155+
- [Windows 10 20H2, 21H2 and 22H2 - April 11 2023 Update](https://support.microsoft.com/help/5025221)
156+
- [Windows Server 2022 - April 11 2023 Update](https://support.microsoft.com/help/5025230)
157+
- [Windows Server 2019 - April 11 2023 Update](https://support.microsoft.com/help/5025229)
158+
159+
### Is Windows LAPS with Azure AD management configuration supported using Group Policy Objects (GPO)?
160+
161+
Yes, for [hybrid Azure AD joined](https://learn.microsoft.com/azure/active-directory/devices/concept-azure-ad-join-hybrid) devices only. See see [Windows LAPS Group Policy](https://learn.microsoft.com/windows-server/identity/laps/laps-management-policy-settings#windows-laps-group-policy).
162+
163+
### Is Windows LAPS with Azure AD management configuration supported using MDM?
164+
165+
Yes, for [Azure AD join](https://learn.microsoft.com/azure/active-directory/devices/concept-azure-ad-join)/[hybrid Azure AD join](https://learn.microsoft.com/azure/active-directory/devices/concept-azure-ad-join-hybrid) ([co-managed](https://learn.microsoft.com/mem/configmgr/comanage/overview)) devices. Customers can use [Microsoft Intune](https://learn.microsoft.com/mem/intune/protect/windows-laps-overview) or any other third party MDM of their choice.
166+
167+
### What happens when a device is deleted in Azure AD?
168+
169+
When a device is deleted in Azure AD, the LAPS credential that was tied to that device is lost and the password that is stored in Azure AD is lost. Unless you have a custom workflow to retrieve LAPS passwords and store them externally, there's no method in Azure AD to recover the LAPS managed password for a deleted device.
170+
171+
### What roles are needed to recover LAPS passwords?
172+
173+
The following built-in roles Azure AD roles have permission to recover LAPS passwords: Global Administrator, Cloud Device Administrator, and Intune Administrator.
174+
175+
### What roles are needed to read LAPS metadata?
176+
177+
The following built-in roles are supported to view metadata about LAPS including the device name, last password rotation, and next password rotation: Global Administrator, Cloud Device Administrator, Intune Administrator, Helpdesk Administrator, Security Reader, Security Administrator, and Global Reader.
178+
179+
### Are custom roles supported?
180+
181+
Yes. If you have Azure AD Premium, you can create a custom role with the following RBAC permissions:
182+
183+
- To read LAPS metadata: *microsoft.directory/deviceLocalCredentials/standard/read*
184+
- To read LAPS passwords: *microsoft.directory/deviceLocalCredentials/password/read*
185+
186+
### What happens when the local administrator account specified by policy is changed?
187+
188+
Because Windows LAPS can only manage one local admin account on a device at a time, the original account is no longer managed by LAPS policy. If policy has the device back up that account, the new account is backed up and details about the previous account are no longer available from within the Intune admin center or from the Directory that is specified to store the account information.
189+
190+
## Next steps
191+
- [Microsoft Intune support for Windows LAPS](https://learn.microsoft.com/mem/intune/protect/windows-laps-overview)
192+
- [Create policy for LAPS](https://learn.microsoft.com/mem/intune)/protect/windows-laps-policy.md)
193+
- [View reports for LAPS](https://learn.microsoft.com/mem/intune/protect/windows-laps-reports.md)
194+
- [Account protection policy for endpoint security in Intune](https://learn.microsoft.com/mem/intune/protect/endpoint-security-account-protection-policy.md)

0 commit comments

Comments
 (0)