Fix Local Admin Password Not Showing in Intune for Windows LAPS
Fix: Local Admin Password Blade Missing in Intune for Windows LAPS
You’ve rolled out Windows LAPS with Intune.
Passwords show up fine in Entra ID → Devices → Local administrator password recovery, but in Intune the Local admin password menu is missing on the device.
In this post, we’ll cover:
- Where the password should appear
- Required roles and permissions
- Why the blade might be missing
- Practical fixes and workarounds (including Graph / PowerShell)
Where You Should See the LAPS Password
Once Windows LAPS is configured and backing up to Entra ID, you can view the local admin password in two main places.
1. Microsoft Entra admin center
- Open the Entra admin center.
- Go to Identity → Devices → All devices.
- Select the device.
- Open Local administrator password recovery.
- Select the device and choose Show local administrator password.
If you see a password here, LAPS backup to Entra is working.
2. Microsoft Intune admin center
- Open the Intune admin center.
- Go to Devices → Windows → All devices.
- Select the device.
- In the left menu, you should see Local admin password.
- Open it and select Show local administrator password.
If the password shows in Entra but the Local admin password menu is missing in Intune, that’s the issue we’re troubleshooting.
Prerequisites Checklist
Before you blame the portal, make sure the basics are correct.
1. Windows LAPS is enabled in Entra
In Entra admin center:
- Go to Identity → Devices → Device settings.
- Confirm Enable Local Administrator Password Solution (LAPS) is set to Yes.
2. LAPS policy is deployed via Intune
In Intune:
- Go to Endpoint security → Account protection.
- Open your Windows LAPS policy.
- Confirm:
- Backup directory is set to Microsoft Entra ID.
- Password settings (length, complexity, rotation) are configured.
- Check the Per-device status and confirm the policy shows as Succeeded for the affected device.
3. Device meets requirements
On the device side, confirm:
- Supported Windows version with LAPS support.
- Device is Entra joined or Hybrid joined.
- Device is managed by Intune and appears in Devices → Windows → All devices.
If these pieces are wrong, fix them first. The Intune blade won’t help until LAPS itself is working.
Roles Required to View LAPS Passwords
Not every admin role can see the LAPS password.
The built-in roles that can normally recover LAPS passwords include:
- Cloud Device Administrator
- Intune Administrator
- Global Administrator (with the right conditions)
If you use PIM (Privileged Identity Management):
- The role must be Active, not just Eligible.
- Check the assignment scope (whole tenant vs. an Administrative Unit).
Even if the account is Global Admin, if the role was just activated or scope is limited, you might not see the LAPS blade yet.
Symptom: Password Visible in Entra, Blade Missing in Intune
Typical pattern:
- LAPS password is visible in Entra → Devices → Local administrator password recovery.
- The Local admin password menu is completely missing on the device blade in Intune.
This usually points to a portal/session/role token issue, not a LAPS misconfiguration, because LAPS is clearly working in Entra.
Step-by-Step Troubleshooting
You can treat this as a quick checklist when helping other admins.
Step 1 – Confirm LAPS is actually backing up to Entra
On the device, check the registry:
- Path:
HKLM\SOFTWARE\Microsoft\Policies\LAPS
Confirm settings such as:
BackupDirectoryis set to the correct value for Entra backup (for Entra ID, value is typically1).
Then in Entra:
- Go to Identity → Devices → All devices.
- Select the device.
- Open Local administrator password recovery and try Show local administrator password.
If you cannot see a password here, you have a policy or backup issue, not an Intune UI issue. Fix LAPS configuration first.
Step 2 – Check roles and scope
- Confirm your account is assigned one of the following:
- Global Administrator
- Cloud Device Administrator
- Intune Administrator
- If using PIM:
- Activate the role.
- Wait a few minutes for the role to be fully effective.
- Ask another admin with the same role to test.
- If they also don’t see the blade, it’s more likely a tenant/portal issue than an individual account issue.
Step 3 – Refresh the Intune session token
This is where many people get stuck. The role is correct, but the browser session still uses an old token.
Try this:
- Sign out of:
- Intune admin center.
- Entra admin center.
- Close the browser completely, or at least clear cookies/sessions for Microsoft URLs.
- Open a new browser window.
- Sign back in with the same admin account.
- Go to:
- Intune admin center → Devices → Windows → [Device]
- Check if Local admin password is now visible in the menu.
Often, this is enough. Especially when:
- Roles were changed recently.
- PIM roles were just activated.
- You have been signed in for a long time with a stale token.
Step 4 – Confirm tenant and feature availability
If the blade is still missing:
- Confirm you’re using https://intune.microsoft.com (Intune admin center) and not a legacy portal.
- If you manage multiple tenants, verify you’re in the correct tenant (check the top-right corner).
- In Intune:
- Go to Tenant administration and verify nothing is blocking new features or relevant blades.
If everything looks correct and the blade is missing for everyone, this may be a temporary service issue or a slow UI rollout for your tenant.
Workarounds: Entra and Graph / PowerShell
While the Intune blade is being stubborn, you still have other ways to get the local admin password.
Option 1 – Use Entra as the primary viewer
You can standardize on Entra for password retrieval:
- Go to Entra admin center.
- Identity → Devices → Local administrator password recovery.
- Search for and select the device.
- Choose Show local administrator password.
This works even if the Intune device blade does not show the menu.
Option 2 – Use Microsoft Graph PowerShell
You can also retrieve passwords with PowerShell through Microsoft Graph.
Example:
# Connect to Microsoft Graph with appropriate permissions
Connect-MgGraph -Scopes "Device.Read.All","Directory.AccessAsUser.All"
# Get LAPS password for a device by Entra device Id
$deviceId = "<EntraDeviceId>"
Get-LapsAADPassword `
-DeviceIds $deviceId `
-IncludePasswords `
-AsPlainText
You can wrap this into a function or script for your helpdesk or engineering team.
For automation, you can also look at the REST endpoint GET /deviceLocalCredentials in Microsoft Graph.
Quick Root Cause Summary
If:
- The LAPS password is visible in Entra, and
- The Local admin password blade is missing in Intune,
then the most likely causes are:
- Stale Intune/Entra session token in the browser.
- Recently activated role (PIM) that hasn’t flowed into the session.
- Occasional portal-side issue or delayed UI rollout in that tenant.
If:
- The password is not visible in Entra either,
then:
- You have a LAPS configuration problem (policy, backup directory, device support) and should fix that first.
