CIS.M365.5.1.4.5 - (L1) Ensure Local Administrator Password Solution is enabled
Overview
5.1.4.5 (L1) Ensure Local Administrator Password Solution is enabled
Local Administrator Password Solution (LAPS) is the management of local account passwords on Windows devices. LAPS provides a solution to securely manage and retrieve the built-in local admin password. With cloud version of LAPS, customers can enable storing and rotation of local admin passwords for both Microsoft Entra and Microsoft Entra hybrid join devices.
The recommended state is Yes.
Rationale
Managing local Administrator passwords across multiple systems can be challenging. As a result, many organizations opt to configure the same password on all workstations and/or member servers during deployment. However, this practice introduces a significant security risk: if an attacker compromises one system and obtains the local Administrator password, they can potentially gain administrative access to every other system using that same password.
Additionally, enabling LAPS at the tenant level is a prerequisite for implementing LAPS-related recommendations outlined in the CIS Microsoft Intune for Windows Workstation Benchmarks.
Note: Enabling LAPS at the tenant level does not automatically enforce password rotation for built-in Administrator accounts. To activate LAPS functionality, appropriate policies must be configured in Intune Settings Catalog or under the Endpoint security > Account protection blade. The CIS Microsoft 365 Foundations Benchmark focuses on hardening at the tenant level, while the CIS Intune Benchmarks focus on endpoint-specific configurations.
Impact
Enabling LAPS requires some additional operational overhead.
Although unlikely if a password is rotated and not retrieved or backed up before the device becomes unreachable (e.g., due to hardware failure, network isolation, or being decommissioned), administrators may be locked out.
Remediation action
- Navigate to Microsoft Entra admin center.
- Expand Entra ID > Devices and select Device settings.
- Set Enable Microsoft Entra Local Administrator Password Solution (LAPS) to Yes.
Related links
- Microsoft Entra admin center - Device settings
- Windows Local Administrator Password Solution in Microsoft Entra ID
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.1.4.5
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.1.4.5 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Related products | Intune |
| Feature | Device identity |
| Area | Privileged access |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.003 Local Accounts |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.1.4.5 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.1.4.5, nist-800-53-r5:IA-5 |
| PowerShell test | Test-MtCisLapsEnabled |
| Services | Graph |
Source
- Test:
tests/cis/Test.CIS.M365.5.1.4.5.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.1.4.5.md