Hi Community,

The first half of the summer holidays is almost history. I decided to write a blog about one of the most anticipated feature releases for macOS: macOS LAPS is finally here.

I can already state this from my personal opinion: is it what I wanted? Does it meet my expectations? The short answer to that is—not quite.

You can use a macOS Automated Device Enrollment (ADE) profile to set up new macOS devices with both admin and standard user accounts, along with Microsoft’s Local Admin Password Solution (LAPS). The macOS LAPS account settings are optional and can be added to both new and existing ADE profiles—whether or not you’re using user affinity. Just keep in mind: these account settings only apply to new device enrollments.

With macOS local account setup using LAPS, the device gets a local admin account with a strong, encrypted, and randomized password. Intune takes care of storing and encrypting that password securely.

The admin password generated by Intune is 15 characters long and includes a mix of uppercase and lowercase letters, numbers, and special symbols.

Do also check out the official Microsoft docs here.

Set up local admin account creation and password management for macOS devices - Microsoft Intune

Set up macOS account configuration with LAPS through automatic device enrollment for macOS devices in Intune.

Prerequisites macOS LAPS

Device Requirements for macOS Local Account Configuration with macOS LAPS:

• macOS 12 or later
• Devices must be synced to Intune via Apple Business Manager or Apple School Manager
• Devices must be enrolled in Intune using a macOS Automated Device Enrollment (ADE) profile

macOS LAPS Intune settings

To create or edit an Apple enrollment profile go to the Intune Portal – Devices – macOS – Enrollment – Enrollment program tokens – profiles. I will create a new profile so click Create profile – macOS.

Give you profile a name e.g. macOS with LAPS and click next.

On the management settings tab i use the following options:

• User affinity – Enroll with User Affinity
• Authentication Method – Setup Assistant with modern authentication
• Await Final configuration – Yes
• Locked Enrollment – Yes

Click next to proceed to the next step.

On the Setup Assistant tab choose what setup screens you want to see during the enrollment and click next.

Now for the Account settings tab, this is where we set the settings for macOS LAPS. We have the option to create an admin and a user account. In my lab, I will create an admin and a user account during the setup assistant.

Now let’s go over the settings for the user account. Basically, the process is the same as for the admin account. We create a standard account. If you want to restrict editing or manage the account name, set the prefill account info to yes.

Now click next, review and create your profile by clicking create.

After the profile is created we need to assign a device to it before we can test it out, so click on your new profile and under manage click assign devices and add devices.

Choose your device from the list of synced devices from Apple Business Manager and click Add.

Now click save.

Enroll Experience

I have made a video that showcases the complete enrollment process. I’m also using PSSO with secure enclave and filevault encryption during setup assistant in this setup. If you want to know more on these topics check out my other guide on how to set this up.

Now when we go to the Intune portal – Devices – macOS – Select your device – Password and keys you can see the password together with the Filevault key, you also can rotate both the filevault key and the password from here.

Issues

I have heard from other guys that there where some issues like the intune agent eating up CPU usage, memory overflows, intune agent crashing and that the admin account need a password change at 1st logon.

Check out the video here for the password change that’s get triggered.

Also a big issue is that the password rotation is not working properly, i have tried a couple of times, i sometimes get Rotate local admin password initiated or initiating rotate local admin password failed. But no rotation of the password. Also no entries in the audit logs for rotateLocalAdminPassword ManagedDevice.

If you look at the time stamps of the audit logs and compare them with the last rotation time stamp you can see that there has been no change at all.

Do play around with it and make sure you test all the things before going live but the people at Microsoft have still some work to do!!

This concludes this blog on macOS LAPS – i would like to have also already enrolled devices to be able to use this but it is what it is unfortunately.

And as always if you feel like there is something in error or if you would like to contribute, don’t hesitate to contact me!