Skip to main content

140: Cloud LAPS

Overview​

Cloud Local Administrator Password Solution (LAPS) for Windows devices in Microsoft Intune is a powerful tool for managing local administrator passwords securely. Here's a detailed overview:

Benefits​

  1. Enhanced Security: Cloud LAPS ensures that each device has a unique, complex local administrator password, reducing the risk of unauthorized access.
  2. Centralized Management: Intune provides a centralized platform for managing local admin passwords, simplifying administration.
  3. Automated Password Rotation: Automatically rotates passwords on a schedule, ensuring they remain secure.
  4. Compliance: Helps meet regulatory requirements by ensuring secure management of local admin accounts.

Drawbacks​

  1. Initial Setup Complexity: Configuring Cloud LAPS can be complex and time-consuming, especially for large organizations.
  2. Maintenance: Ongoing maintenance is required to ensure the system remains secure and functional.
  3. Compatibility Issues: Potential compatibility issues with older devices or systems that do not fully support Cloud LAPS.

Impact on End Users​

  • Improved Security: Users benefit from enhanced security without needing to take additional actions.
  • Minimal Disruption: Properly configured Cloud LAPS can be deployed with minimal disruption to users.
  • Recovery Support: Users have access to recovery options if they forget their local admin password.

Steps to Deploy Cloud LAPS​

  1. Enable Cloud LAPS: In the Azure Active Directory (AAD) or Microsoft Entra Admin portal, navigate to Devices > All devices > Device Settings. Toggle the option to enable Microsoft Entra Local Administrator Password Solution (LAPS) to "Yes" and save.
  2. Configure Intune Policies: In Intune, create a new policy for account protection and configure the LAPS settings, including password complexity and rotation schedule.
  3. Assign Policies: Assign the LAPS policy to the appropriate groups of devices or users.
  4. Monitor and Adjust: Continuously monitor the deployment and make adjustments as needed.

Tying to Zero Trust​

Zero Trust is a security model that assumes no implicit trust and continuously verifies every request. Deploying Cloud LAPS through Intune aligns with Zero Trust principles by:

  • Ensuring Secure Access: Cloud LAPS enforces unique, complex passwords for local admin accounts, ensuring only authorized access.
  • Continuous Verification: Regularly updated passwords help maintain secure access, aligning with the continuous verification aspect of Zero Trust.
  • Reducing Attack Surface: By managing local admin passwords centrally, Cloud LAPS reduces the potential attack surface.

Reference​