Please confirm:
Problem Statement
Hello,
Windows LAPS supports backing up local administrator passwords directly to Microsoft Entra ID for Entra-joined and hybrid-joined devices without requiring Intune.
In CIPP, these devices appear under Identity Management > Administration > Devices, but that page does not provide a Retrieve LAPS Password action.
CIPP currently provides this action only under Intune > Device Management > Devices. That page relies on the Intune managed-devices inventory and is unavailable for devices that are not enrolled in Intune.
As a result, you must leave CIPP and open the Microsoft Entra admin center to retrieve a LAPS password, even though Entra stores the device and its LAPS credential.
Please add a Retrieve LAPS Password action to Identity Management > Administration > Devices, with functionality equivalent to the existing action on the Intune Devices page.
Thank you!
Benefits for MSPs
This would let MSP technicians retrieve Entra-backed LAPS passwords directly from CIPP for any supported Entra-joined or hybrid-joined device, whether or not the device is enrolled in Intune.
Benefits include:
- Reducing portal switching and manual navigation through individual Entra tenants.
- Providing a consistent, centralized multi-tenant workflow for local administrator credential recovery.
- Supporting clients that use Entra-backed Windows LAPS without Intune.
- Improving response time during endpoint troubleshooting and recovery.
- Encouraging broader adoption of unique, automatically rotated local administrator passwords.
- Providing LAPS retrieval alongside the existing BitLocker key retrieval action on the Entra Devices page.
Value or Importance
This is a high-value security and operational improvement for MSPs.
No Intune licensing or enrollment is required for Entra-backed Windows LAPS itself. Windows LAPS can store passwords directly in Microsoft Entra ID, including with Microsoft Entra ID Free, and devices do not need to be Intune-managed.
Many small and mid-sized organizations use Entra ID without Intune. Their LAPS credentials are already securely stored in Entra, and their devices are already visible on CIPP’s Entra Devices page.
Adding the retrieval action would make CIPP’s existing LAPS functionality available to a much broader set of managed tenants and devices.
PowerShell Commands (Optional)
Microsoft supports retrieving an Entra-backed Windows LAPS password through the Windows LAPS PowerShell module and Microsoft Graph:
Get-LapsAADPassword -DeviceIds "" -IncludePasswords -AsPlainText
Retrieving the plaintext password requires the appropriate Microsoft Graph permissions, including Device.Read.All and DeviceLocalCredential.Read.All.
CIPP already provides equivalent retrieval functionality from the Intune Devices page. The requested change is to expose that functionality for devices listed on the Entra Devices page.
Please confirm:
Problem Statement
Hello,
Windows LAPS supports backing up local administrator passwords directly to Microsoft Entra ID for Entra-joined and hybrid-joined devices without requiring Intune.
In CIPP, these devices appear under Identity Management > Administration > Devices, but that page does not provide a Retrieve LAPS Password action.
CIPP currently provides this action only under Intune > Device Management > Devices. That page relies on the Intune managed-devices inventory and is unavailable for devices that are not enrolled in Intune.
As a result, you must leave CIPP and open the Microsoft Entra admin center to retrieve a LAPS password, even though Entra stores the device and its LAPS credential.
Please add a Retrieve LAPS Password action to Identity Management > Administration > Devices, with functionality equivalent to the existing action on the Intune Devices page.
Thank you!
Benefits for MSPs
This would let MSP technicians retrieve Entra-backed LAPS passwords directly from CIPP for any supported Entra-joined or hybrid-joined device, whether or not the device is enrolled in Intune.
Benefits include:
Value or Importance
This is a high-value security and operational improvement for MSPs.
No Intune licensing or enrollment is required for Entra-backed Windows LAPS itself. Windows LAPS can store passwords directly in Microsoft Entra ID, including with Microsoft Entra ID Free, and devices do not need to be Intune-managed.
Many small and mid-sized organizations use Entra ID without Intune. Their LAPS credentials are already securely stored in Entra, and their devices are already visible on CIPP’s Entra Devices page.
Adding the retrieval action would make CIPP’s existing LAPS functionality available to a much broader set of managed tenants and devices.
PowerShell Commands (Optional)
Microsoft supports retrieving an Entra-backed Windows LAPS password through the Windows LAPS PowerShell module and Microsoft Graph:
Get-LapsAADPassword -DeviceIds "" -IncludePasswords -AsPlainText
Retrieving the plaintext password requires the appropriate Microsoft Graph permissions, including Device.Read.All and DeviceLocalCredential.Read.All.
CIPP already provides equivalent retrieval functionality from the Intune Devices page. The requested change is to expose that functionality for devices listed on the Entra Devices page.