Windows Local Administrator Password Solution with Microsoft Entra ID now generally available!

JaySimmons even though the policy is rolled out on devices and devices are compliant, I do not see the password in devices > deviceid > local admin password. Have not checked Eventlog yet. 
since ADPasswordEncryptionPrincipal is missing in Endpoint security > account security policy, do I assume correctly this one needs to be added via custom CSP policies and this AD (Entra AD synced) group need the correct permissions?

Deleted if your local Administrator is disabled, I believe it would take more efforts to misuse it for attacks. Some even rename this one for higher security. In your scenario, in case of unfortunate events how do you recover Bitlocker, uninstall CUs in WinRE locally?

Thank you JaySimmons for your helpful guidance. I believed the settings catalog remains as a central hub for all policies. Your screenshot helped me a lot.
Maybe Sandeep Deo would like to update his original post as it is not mentioning this place but just refer to CSP and GPO, instead of the configuration plane you showed where Windows LAPS configuration is much more accessible.

I am missing "ADPasswordEncryptionPrincipal" in the Endpoint Security > Account protection

Does all this is recommended even in a cloud only-scenario? All devices are signed to Entra ID and managed by Intune. Local admin and guest accounts are disabled.

EventfulWahlgren We have integrated password recovery experience into Intune console and will work with Intune to get it added to the Intune for Education console.

Deleted ,

I think you are looking at the legacy LAPS Intune settings - the old-vs-new naming conflict can cause confusion.   

EDIT: you may have been already aware of this distinction, if so apologies and back to Sandeep Deo for your original request.

When you create an Intune policy for Windows LAPS, you should see something that looks like this:

Assuming your Intune mgmt portal looks the same as mine, you should be able to create a Windows LAPS policy via the following workflow:

Endpoint Security -> Account protection -> Create Policy -> set Platform to "Windows 10 and later" -> set Profile to "Local admin password solution (Windows LAPS".

Side note:  the legacy LAPS Intune settings were managed via straightforward ADMX registry mappings, as opposed to an inbox CSP which is what Windows LAPS supports.

hth,

Jay

I'd love to see the ability to get the password integrated into Intune for Education. We use IfE with municipalities to make sure admins only have access to their students and devices, and the access to bitlocker keys has been beneficial, as I'm sure LAPS would be aswell if released.

another question: 

for easier adoption, is it planned that CSP policies will be merged into settings catalog? This would be very helpful
https://learn.microsoft.com/windows/client-management/mdm/laps-csp

edit:

LAPS is in the settings catalog. Is this one complete or do we still need to tinker with CSP policies?

edit2: unfortunately, the settings catalog is incomplete and won't help to get Windows LAPS activated.

Sandeep Deo would you mind to ask internally, that the Windows LAPS settings will be included into settings catalog for easier configuration? Thank you very much in advance!

Dear Sandeep Deo

thank you for this magnificient addition and work on Windows LAPS.

Some parts in regards of Windows Server are unclear to me and I hope you can shed some light. 

It is true that Windows LAPS can either save secrets to Entra ID (GPO says Azure AD) and local AD DS. 

The announcement of Merill reads like Entra ID is required. I understand that yours and Merill's announcement focus on Windows LAPS for Entra ID, but should differentiate that is also possible to use it on-premises only for Windows Server and, if one wants to also Windows Client. 

I have few questions on the mentioned hybrid join or Entra only joined devices. 

Q: What is the preferred procedere to join Windows Server to Entra ID only or Hybrid?

Asking because Windows Server Core (GUI less) doesn't offer dsregcmd, very unfortunately.

Q: can we bring dsregcmd to Windows Server Core for feature parity. It exist on the GUI variant?

Q: I could imagine that joining Windows Server through Azure Arc is enough to make it hybrid joined. Is it? How about Entra Only, is it possible? 

Q: Does Windows LAPS work with Entra Directory Services (former Azure AD Domain Controllers)?