Windows Hello for Business, LAPS and Local Groups

What it is

Three Windows features reduce the risk of stolen passwords. Windows Hello for Business replaces passwords with a PIN or biometric tied to the device. Windows LAPS (Local Administrator Password Solution) gives each device a unique, rotating local administrator password. Local group membership policy controls who is in groups such as Administrators. You configure all three with Intune.

How it works

Windows Hello for Business

Hello for Business is a strong, two factor credential: the device (with its TPM) plus a PIN or biometric. The private key stays on the device, so the secret cannot be replayed from another machine. You configure it in Intune in two ways.

• Tenant wide at enrollment: under Devices, Enrollment, Windows, Windows Hello for Business, a default that applies as devices enroll.
• Targeted policy: an Account protection policy (Endpoint security) or a settings catalog policy for groups.

Common settings:

For a hybrid device that needs on premises resources, the cloud Kerberos trust model is the simplest, because it needs no certificates.

Windows LAPS

Windows LAPS creates a random local administrator password on each device, stores it in the directory and rotates it. A stolen password then only opens one device. Setup has three parts.

1. Entra tenant setting: to store passwords in Entra ID, turn on Enable Microsoft Entra Local Administrator Password Solution (LAPS) in device settings.
2. Intune policy: Endpoint security, Account protection, create a Local admin password solution (Windows LAPS) policy. Key settings:

1. Permissions: to view a password you need the Entra permission microsoft.directory/deviceLocalCredentials/password/read. The Cloud Device Administrator and Intune Administrator roles can read it. A custom role can have just that permission.

Operations to know:

• The Rotate local admin password remote action rotates it on demand, and it restarts the age timer. It needs a successful earlier backup.
• Passwords are visible in the Intune admin center only when backed up to Entra ID, not to Active Directory.
• Changing the password age does not rotate the password immediately.
• LAPS with Entra ID is not supported for Entra registered devices, and a conflicting policy (GPO or legacy LAPS) can block the backup. The Account protection report shows conflicts.

Local group membership

An Account protection policy of type Local user group membership controls who belongs to a local group. You choose:

• The local group, such as Administrators, Users, Remote Desktop Users or Power Users.
• The action: Add (Update), Remove (Update) or Add (Replace). Replace removes everyone not listed.
• The members: users or groups from Entra ID, or manual entries by name or SID.

Use Replace to make the Administrators group contain only approved accounts, which removes drift. Use Add to give a help desk group admin rights without touching other members. Combine with LAPS so the built in account stays protected.

A worked scenario

A company wants no shared admin passwords, and a PIN instead of a password for office staff. The admin turns on the Entra LAPS setting, creates a LAPS policy with backup to Entra ID, a 14 day password age and the built in administrator, and gives help desk staff a role with password read. She enables Windows Hello for Business through the tenant wide enrollment policy with TPM required, and a local group policy that replaces the Administrators group membership with the IT admin group.