Back to Checks
m365

Microsoft Entra Local Administrator Password Solution (LAPS) is enabled

entra_device_registration_laps_enabled
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

The tenant device registration policy should enable Microsoft Entra Local Administrator Password Solution (LAPS) (localAdminPassword.isEnabled). LAPS securely manages and rotates the built-in local administrator password on Windows devices and stores it for controlled retrieval.

Prowler logoProwlerprowler-provider-m365

Risk

Without LAPS, local administrator passwords are often static and shared across devices, enabling lateral movement: an attacker who recovers one device's local admin password can reuse it across the fleet.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_device_registration_laps_enabled

Recommendation

Enable Microsoft Entra LAPS and deploy a matching Intune policy so local administrator passwords are unique per device, rotated automatically, and retrievable only by authorized roles.

Remediation

Other

1Navigate to the Microsoft Entra admin center at https://entra.microsoft.com/
2Go to **Identity** > **Devices** > **Device settings**
3Set **Enable Microsoft Entra Local Administrator Password Solution (LAPS)** to **Yes**
4Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client


class entra_device_registration_laps_enabled(Check):
    """Check if Microsoft Entra Local Administrator Password Solution (LAPS) is enabled.

    The device registration policy should enable LAPS so that the built-in local
    administrator password on Windows devices is securely managed and rotated.

    - PASS: LAPS is enabled.
    - FAIL: LAPS is disabled.
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the Microsoft Entra LAPS enablement check.

        Returns:
            List[CheckReportM365]: A list containing the result of the check.
        """
        findings = []
        policy = entra_client.device_registration_policy
        if not policy:
            return findings

        report = CheckReportM365(
            metadata=self.metadata(),
            resource=policy,
            resource_name="Device Registration Policy",
            resource_id="deviceRegistrationPolicy",
        )
        report.status = "FAIL"
        report.status_extended = (
            "Microsoft Entra Local Administrator Password Solution (LAPS) is disabled."
        )

        if policy.local_admin_password_enabled:
            report.status = "PASS"
            report.status_extended = (
                "Microsoft Entra Local Administrator Password Solution (LAPS) is "
                "enabled."
            )

        findings.append(report)
        return findings

References