How to check LAPS password backups in Microsoft Intune

Before you start

Use an account with a role Microsoft lists for reading LAPS details without the password: Cloud Device Administrator, Intune Administrator, Helpdesk Administrator, Security Administrator, Security Reader or Global Reader. LAPS works with Microsoft Entra ID Free or higher. The PowerShell example requests DeviceLocalCredential.ReadBasic.All, which lists backups without their passwords, and Device.Read.All; your organisation may require administrator consent.

LAPS covers Windows devices joined or hybrid joined to Microsoft Entra ID, not registered devices. The backups are read as Entra ID holds them now. Recovering a password is recorded in the audit log, and none of the steps here recover one. The examples read and export; they change nothing and reveal no password.

Option 1

Check LAPS password backups with PowerShell

Install the modules once, then connect, read the devices and the backups and match them by device ID.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication,
    Microsoft.Graph.Identity.DirectoryManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'DeviceLocalCredential.ReadBasic.All', 'Device.Read.All' -NoWelcome
try {
    $properties = 'deviceId', 'displayName', 'operatingSystem', 'trustType', 'accountEnabled'
    # Entra joined (AzureAd) and hybrid joined (ServerAd), not registered personal devices.
    $filter = "trustType in ('AzureAd', 'ServerAd')"
    $devices = @(Get-MgDevice -All -Filter $filter -Property $properties |
        Where-Object { $_.OperatingSystem -like 'Windows*' })
    $backups = @{}
    # Each backup's ID is the device ID of the device it came from.
    foreach ($backup in Get-MgDirectoryDeviceLocalCredential -All) {
        $backups[$backup.Id] = $backup
    }
    $report = foreach ($device in $devices) {
        $backup = $backups[$device.DeviceId]
        [pscustomobject]@{
            Device = $device.DisplayName
            TrustType = $device.TrustType
            Enabled = $device.AccountEnabled
            BackedUp = $null -ne $backup
            LastBackup = $backup.LastBackupDateTime
            NextRotation = $backup.RefreshDateTime
        }
    }
    $report = @($report | Sort-Object BackedUp, Device)
    $missing = @($report | Where-Object { -not $_.BackedUp }).Count
    if ($report.Count -eq 0) {
        Write-Output 'No Windows device is joined to Microsoft Entra ID.'
    } else {
        $report | Export-Csv -Path './laps-backups.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$missing of $($report.Count) Windows devices have no LAPS password."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The CSV has 1 row for each joined Windows device, those with no backup first, with when its password was last backed up and when it's next due to change. A next rotation well in the past points to a device that hasn't been online to change it. To keep disabled devices out, add -and $_.AccountEnabled after the operating system test.

Option 2

Check LAPS backups in the Entra admin centre

1. Sign in to the Microsoft Entra admin centre for the correct tenant.
2. Go to Entra ID > Devices > Overview > Device settings and read whether Enable Local Administrator Password Solution (LAPS) is set to Yes. Leave the page without selecting Save.
3. Go to Entra ID > Devices > Overview > Local administrator password recovery to list the devices with a password backed up.
4. Compare that list with your Windows devices. Leave the passwords hidden: recovering one is recorded in the audit log.

This suits confirming the tenant setting and looking up a device. The list shows the devices that have a backup, not the ones without, so for the gaps use PowerShell or a report.

Common questions

Why does a device have no password backed up?

Check both halves of the setup. Microsoft says the tenant setting must be on and a policy on the device must set its backup directory to Microsoft Entra ID, through Intune or, for hybrid joined devices, Group Policy. The device also needs a Windows version with the April 2023 update or later.

What happens to the password when a device is deleted?

It's lost. Microsoft says deleting a device in Entra ID deletes the password stored with it, and there's no way to recover it there afterwards.

Are BitLocker recovery keys backed up the same way?

They're kept with the device in Entra ID too, and a device can have one without the other. See how to find missing BitLocker recovery keys in Intune.