Can Azure AD Users View Local Administrator Passwords with Windows LAPS?
Question details
The user wants to know if standard Azure AD users have the ability to view local administrator passwords backed up via Windows LAPS in a hybrid environment.
- Product
- Windows LAPS / Azure AD
- Device & OS
- not provided
- Scenario
- Managing local administrator passwords and role-based access in a hybrid Azure AD environment.
- Observed behavior
- Standard users generally cannot access passwords for assigned devices unless explicit permissions are configured by an administrator.
Ensure you have global administrator or equivalent access rights in your Azure AD (Microsoft Entra ID) tenant to view or modify Windows LAPS security policies.
Manage Windows LAPS Permissions via Azure AD
Standard users do not have access by default. You must explicitly verify or assign role-based access control (RBAC) permissions to allow password retrieval.
Windows LAPS password retrieval is strictly controlled by Azure AD permissions and device management policies. Passwords backed up to the cloud are encrypted and restricted from standard users to maintain security.
To grant or audit access, administrators must configure specific roles within the Microsoft Entra admin center.
Log in to the Microsoft Entra admin center with an administrative account.
Go to the 'Devices' section on the left-hand menu, then select 'Local administrator password recovery' to review access logs and policies.
Ensure that standard users are not inadvertently assigned elevated roles such as 'Cloud Device Administrator' or 'Intune Administrator', which could grant them permission to retrieve passwords.
Document Your IT Policies Effectively with WPS Office
While configuring Azure AD and Windows LAPS requires Microsoft administrative tools, documenting your security policies and permission structures doesn't require an expensive Microsoft Office subscription. WPS Office offers a free, lightweight, and highly compatible alternative for IT teams.
- 1. Download the Software: Visit the official WPS Office website and click the free download button.
- 2. Install WPS Office: Run the lightweight installer on your administrative workstation.
- 3. Open Policy Documents: Launch WPS Writer to instantly open, edit, or create IT security policy documents in .docx format.
Frequently Asked Questions
Where are Windows LAPS passwords stored in a hybrid environment?
In a hybrid setup, Windows LAPS can be configured to back up local administrator passwords directly to Azure Active Directory (Microsoft Entra ID) or to an on-premises Windows Server Active Directory.
Can a standard user recover a local admin password for their own device?
No. By default, standard users do not have the required Azure AD permissions to retrieve local administrator passwords for any devices, even the ones explicitly assigned to them.
Who can view LAPS passwords in Azure AD?
Only users with specific administrative roles, such as Global Administrator or Cloud Device Administrator, or those explicitly granted custom RBAC permissions by an administrator, can view the backed-up passwords.
