How to configure LAPS for MacOS in Microsoft Intune

-
The July 2025 update to Microsoft Intune introduces an intriguing new feature: The Local Administrator Password Solution (LAPS) for macOS. (What’s new in Microsoft Intune: July 2025 - Microsoft Intune Blog)




Below, I'll go through all the prerequisites and actions you'll need to activate this option in Microsoft Intune.

đź› ️Prerequisites

  • MacOS version 12 or later
  • Devices must be synced with Apple Business Manager or Apple School Manager
  • Enrollment must use Automated Device Enrollment (ADE) via Intune
  • Admin must have appropriate RBAC permissions in Intune to view or rotate password
    • Category: Enrollment programs
      • Set Rotate macOS admin password to Yes
      • Set View macOS admin password to Yes

đź“‹ Step-by-Step Configuration Guide

1. Create an ADE Enrollment Profile

  • Go to Microsoft Intune Admin Center
  • Navigate to: Devices > macOS > Enrollment > Enrollment Program Tokens
  • Select your token and create a new ADE profile
  • Enable "Create a local admin account" and configure password settings

2. Enable macOS LAPS Settings

  • In the ADE profile, configure:
    • Local Admin Account: Enable creation
    • Password Rotation: Set to rotate every 6 months (default)
    • Password Complexity: Intune generates a 15-character password with uppercase, lowercase, numbers, and symbols

3. Assign the ADE Profile to Devices

  • Assign the profile to devices synced from Apple Business/School Manager
  • Devices must be newly enrolled or re-enrolled to apply LAPS settings

4. Monitor and Manage Passwords

  • After enrollment, go to Devices > macOS > Device Name
  • Under Local Admin Account, view or manually rotate the password
    • Only users with proper RBAC roles can access this information