What is LAPS for Azure Arc (preview)?

LAPS for Azure Arc enables you to configure and manage Windows Local Administrator Password Solution (LAPS) settings on supported Windows Server and client versions across Azure VMs and Azure Arc-connected machines. LAPS for Azure Arc integrates seamlessly with Azure Governance services (Policy, Machine Configuration) so you can:

  • Ensure compliance with LAPS standards in your industry or organization
  • Reduce attack surface by automating local administrator password backup and rotation
  • Ensure consistent LAPS setup across your fleet for security and productivity

Windows LAPS is a built-in Windows feature that automatically manages and backs up the password of local administrator accounts. It can store passwords in Microsoft Entra ID (formerly Azure AD) or Active Directory and supports password rotation and other post-authentication actions.

To help you demonstrate compliance to auditors (and to help you take action where needed) each compliance check includes evidence via the Reasons field indicating how compliance or non-compliance was determined.

You can customize the LAPS parameters (password length, backup directory, post-authentication actions, etc.) or use the policy default values, which are aligned to Microsoft security best practices including NIST and CIS standards.

Documentation for getting started

Selecting audit-only vs. audit-and-configure behavior

When assigning the LAPS policy, you can choose audit-only (aka "Audit") behavior or audit-and-configure (aka "Configure") behavior using a switch within the same policy assignment.

Policy effect Notes on what to expect
Audit-only behavior auditIfNotExists The policy checks machine configuration against the specified LAPS settings and reports compliance status. No changes are made to the machine. Expect to see Non-compliant states reported if machines don't match the policy.
Audit-and-configure behavior deployIfNotExists The policy checks machine configuration and automatically applies the specified LAPS settings to bring machines into compliance. Expect to see Non-compliant states reported initially, followed by eventual Compliant states as machines are reconfigured.

For existing machines, admins typically start with audit-only behavior to determine existing state and identify any dependencies or conflicts with current LAPS configurations. After reviewing the compliance results, you would then transition to audit-and-configure behavior (with safe deployment practices such as deployment rings).

For greenfield scenarios or test machines, you might choose to skip the analysis phase and move directly to audit-and-configure behavior, starting fresh with strong LAPS defaults.

Caution

Before configuring any machines, take great care to validate your new configuration. You could accidentally disrupt access to your machines.

Examples of potential issues include:

  • The BackupDirectory setting doesn't match your organization's identity infrastructure (for example, setting it to Active Directory when machines aren't domain-joined)
  • The ADPasswordEncryptionPrincipal is not configured correctly, preventing authorized administrators from decrypting passwords
  • Post-authentication actions are too aggressive for your environment, causing unexpected user sign-outs or reboots

To get hands-on experience with LAPS for Azure Arc, see the Quickstart: Configure LAPS for Azure Arc with a test machine.

LAPS configuration scope: settings, defaults, and customization

The following table lists the items that can be audited or configured with LAPS for Azure Arc. Each of these is known as a setting.

Each setting has a default configuration value, aligned to Microsoft security best practices including NIST and CIS standards.

Settings can be given custom values via policy assignment parameters to audit against or configure. For example, if the standard in your organization is to use a 20-character password (rather than 15), you would set the corresponding parameter in the policy assignment.

When customizing values, take care to provide values which are compatible with Windows LAPS. For reference, see the Windows LAPS CSP documentation.

Setting name Default value Description
BackupDirectory 1 (Microsoft Entra ID) Determines where LAPS stores the password backup. Values: 0 = disabled, 1 = Microsoft Entra ID, 2 = Active Directory
AdministratorAccountName null Configures which local account LAPS manages. Defaults to the built-in administrator account when null. Ignored when automatic account management is enabled.
PasswordAgeDays 30 Specifies maximum password age in days. Minimum: 1 day for AD, 7 days for Entra ID. Maximum: 365 days.
PasswordLength 15 Sets password length. Range: 8–64 characters. Default aligns with NIST minimum password length recommendations.
PassphraseLength 6 Sets number of words in a passphrase. Range: 3–10 words.
PasswordComplexity 4 Controls complexity options. Values: 1 = uppercase only, 2 = uppercase + lowercase, 3 = uppercase + lowercase + numbers, 4 = uppercase + lowercase + numbers + special characters, 5–8 = passphrase options.
PasswordExpirationProtectionEnabled True Enforces the maximum password age, preventing password expiration tampering.
ADPasswordEncryptionEnabled True Sets whether passwords are encrypted when stored in Active Directory.
ADPasswordEncryptionPrincipal null Specifies who can decrypt passwords in Active Directory. When null, only Domain Admins can decrypt passwords by default.
ADEncryptedPasswordHistorySize 0 Sets how many previous encrypted passwords are retained in Active Directory. 0 = no history retained.
PostAuthenticationResetDelay 8 Defines how long (in hours) after a password is used before post-authentication actions occur. Aligned with CIS recommendations.
PostAuthenticationActions 3 Defines what actions to take after a password is used. Values: 1 = reset password, 3 = reset password + sign out users + terminate processes, 5 = reset password + reboot.
AutomaticAccountManagementEnabled False Enables automatic management of the local administrator account.
AutomaticAccountManagementTarget 1 Targets account type for automatic management. Values: 0 = built-in administrator, 1 = new managed account.
AutomaticAccountManagementNameOrPrefix WLapsAdmin Name or prefix for the automatically managed account.
AutomaticAccountManagementEnableAccount False Enables the automatically managed account.
AutomaticAccountManagementRandomizeName False Randomizes the automatically managed account name.

Note

Additional policy assignment parameters: When assigning the policy, two additional parameters are available: Include Arc connected servers (default: FALSE — selecting this option incurs a monthly charge per Arc connected machine) and Effect (enable/disable the policy execution and choose between audit-only or audit-and-configure behavior).

How does this fit together?

LAPS for Azure Arc uses Azure Policy and Machine Configuration to audit and configure LAPS settings on your machines. Your core action is to create a policy assignment that links a policy definition to a scope (such as a subscription or resource group). The Machine Configuration service and agent handle the OS-level auditing and configuration. For details on these concepts, see Understand the Machine Configuration feature of Azure Automanage.

Supported operating systems

LAPS for Azure Arc is supported on the following Windows versions:

Windows Client

Windows Server

Verifying LAPS configuration locally

After applying the LAPS policy, you can verify the configuration is working locally on your machines.

Note

Before checking your device(s) status, ensure that you are domain-joined or you may run into errors.

  1. Connect to your VM via RDP or Azure Bastion

  2. Open an elevated PowerShell window and run:

    Invoke-LapsPolicyProcessing
Reset-LapsPassword -Verbose

  3. Open Event Viewer and navigate to Applications and Services Logs > Microsoft-Windows-LAPS

  4. Verify that events indicate successful LAPS configuration and password management

Note

For Active Directory-backed LAPS configurations, you can use Get-LapsADPassword -Identity $env:COMPUTERNAME to retrieve password information. Only authorized principals (as defined by ADPasswordEncryptionPrincipal) can decrypt and view the password.

How can I query the results programmatically?

Using Azure Resource Graph (ARG) queries you can integrate assignment and status data into your own workflows. These examples use Search-AzGraph in PowerShell to execute the ARG query, but PowerShell is not required. You can use ARG from many entry points including the Azure Portal, Azure CLI, REST calls, etc.

  1. At the highest altitude of summarization, you can get machine counts per compliance status bucket:

    $machineCountsQuery = @'
// LAPS machine counts by compliance status
guestconfigurationresources
| where name contains "LAPS"
| extend complianceStatus = tostring(properties.complianceStatus)
| summarize machineCount = count() by complianceStatus
'@

Search-AzGraph -Query $machineCountsQuery

  2. To drill in such that you see overall compliance status by machine:

    $machinePerRowQuery = @'
// LAPS machine level compliance
guestconfigurationresources
| where name contains "LAPS"
| project 
 machine = split(properties.targetResourceId,'/')[-1],
 complianceStatus = properties.complianceStatus,
 lastComplianceStatusChecked = properties.lastComplianceStatusChecked
'@

Search-AzGraph -Query $machinePerRowQuery

  3. To drill down to setting-by-setting details:

    $settingPerRowQuery = @'
// LAPS setting level detail
GuestConfigurationResources
| where name contains "LAPS"
| project report = properties.latestAssignmentReport,
 machine = split(properties.targetResourceId,'/')[-1],
 lastComplianceStatusChecked=properties.lastComplianceStatusChecked
| mv-expand report.resources
| project machine,
 setting = report_resources.resourceId,
 settingComplianceStatus = report_resources.complianceStatus,
 settingComplianceReason = report_resources.reasons[0].phrase,
 lastComplianceStatusChecked
'@

Search-AzGraph $settingPerRowQuery
  • Last updated on