Get-MgLAPSPassword

SYNOPSIS

Retrieves the LAPS password for a Microsoft Entra ID device.

SYNTAX

Default (Default)

Get-MgLAPSPassword [-DeviceName <string>] [-DeviceID <string>] [-ShowPassword]
 [-IncludeHistory] [-RunFromAzureAutomation]

KeyVault

Get-MgLAPSPassword -BackupToKeyVault -KeyVaultName <string>
 [-DeviceName <string>] [-DeviceID <string>] [-ShowPassword] [-IncludeHistory]
 [-RunFromAzureAutomation]

DESCRIPTION

Gets the Windows Local Administrator Password Solution (LAPS) password for one or all devices in Microsoft Entra ID (formerly Azure AD). By default, only metadata is returned (no password). Use -ShowPassword to retrieve the password in plain text. Passwords can optionally be backed up to an Azure Key Vault.

EXAMPLES

EXAMPLE 1

Get-MgLAPSPassword

Retrieves metadata (no password) for all devices with LAPS configured.

EXAMPLE 2

Get-MgLAPSPassword -DeviceName "DESKTOP-ABC123"

Retrieves metadata (no password) for the device with the specified display name.

EXAMPLE 3

Get-MgLAPSPassword -DeviceID "12345678-1234-1234-1234-123456789012"

Retrieves metadata (no password) for the specified device.

EXAMPLE 4

Get-MgLAPSPassword -ShowPassword

Retrieves the current LAPS password in plain text for all devices.

EXAMPLE 5

Get-MgLAPSPassword -DeviceID "12345678-1234-1234-1234-123456789012" -ShowPassword

Retrieves the current LAPS password in plain text for the specified device.

EXAMPLE 6

Get-MgLAPSPassword -DeviceID "12345678-1234-1234-1234-123456789012" -ShowPassword -IncludeHistory

Retrieves the current and historical LAPS passwords for the specified device. The IsCurrent property indicates which entry is the active password.

EXAMPLE 7

Get-MgLAPSPassword -BackupToKeyVault -KeyVaultName "MyLAPSVault"

Backs up LAPS passwords for all devices to Azure Key Vault.

EXAMPLE 8

Get-MgLAPSPassword -DeviceID "12345678-1234-1234-1234-123456789012" -BackupToKeyVault -KeyVaultName "MyLAPSVault"

Backs up the LAPS password for the specified device to Azure Key Vault.

EXAMPLE 9

Get-MgLAPSPassword -RunFromAzureAutomation -BackupToKeyVault -KeyVaultName "MyLAPSVault"

Backs up LAPS passwords for all devices using managed identity authentication. Suitable for Azure Automation runbooks.

PARAMETERS

-BackupToKeyVault

Enable backup of LAPS passwords to Azure Key Vault. Must be used together with -KeyVaultName. The secret name is the device name; the Content Type field contains the account name and backup date.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: KeyVault
  Position: Named
  IsRequired: true
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-DeviceID

Filter results to a specific device by its Entra ID (Azure AD) object ID. If not specified, retrieves LAPS passwords for all devices. Cannot be used together with DeviceName parameter.

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-DeviceName

Filter results to a specific device by its display name. Cannot be used together with DeviceID parameter.

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-IncludeHistory

Include previous LAPS passwords in the output, in addition to the current one. Only applicable when -ShowPassword or -BackupToKeyVault is specified. Has no effect otherwise. The output includes an IsCurrent property to identify the active password.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-KeyVaultName

Name of the Azure Key Vault to back up LAPS passwords to. Mandatory when -BackupToKeyVault is specified. Requires the Az.KeyVault module and appropriate permissions.

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: KeyVault
  Position: Named
  IsRequired: true
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-RunFromAzureAutomation

Use managed identity authentication instead of interactive authentication. Suitable for Azure Automation runbooks, Azure Functions, or VMs with managed identity enabled.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ShowPassword

Retrieve and display the LAPS password in plain text. By default, only metadata (expiration time, etc.) is returned. Use with caution, as this will expose the password in the console output.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

NOTES

Requires the DeviceLocalCredential.Read.All and Device.Read.All permissions in Microsoft Entra ID.

https://ps365.clidsys.com/docs/commands/Get-MgLAPSPassword

Getting started

Azure

Entra

Exchange

Intune

M365 Apps

Misc

MS Commerce

Share Point

Unified Logs

Get-MgLAPSPassword

Get-MgLAPSPassword

SYNOPSIS

SYNTAX

Default (Default)

KeyVault

DESCRIPTION

EXAMPLES

EXAMPLE 1

EXAMPLE 2

EXAMPLE 3

EXAMPLE 4

EXAMPLE 5

EXAMPLE 6

EXAMPLE 7

EXAMPLE 8

EXAMPLE 9

PARAMETERS

-BackupToKeyVault

-DeviceID

-DeviceName

-IncludeHistory

-KeyVaultName

-RunFromAzureAutomation

-ShowPassword

CommonParameters

INPUTS

OUTPUTS

NOTES

​Get-MgLAPSPassword

​SYNOPSIS

​SYNTAX

​Default (Default)

​KeyVault

​DESCRIPTION

​EXAMPLES

​EXAMPLE 1

​EXAMPLE 2

​EXAMPLE 3

​EXAMPLE 4

​EXAMPLE 5

​EXAMPLE 6

​EXAMPLE 7

​EXAMPLE 8

​EXAMPLE 9

​PARAMETERS

​-BackupToKeyVault

​-DeviceID

​-DeviceName

​-IncludeHistory

​-KeyVaultName

​-RunFromAzureAutomation

​-ShowPassword

​CommonParameters

​INPUTS

​OUTPUTS

​NOTES

​RELATED LINKS

Get-MgLAPSPassword

SYNOPSIS

SYNTAX

Default (Default)

KeyVault

DESCRIPTION

EXAMPLES

EXAMPLE 1

EXAMPLE 2

EXAMPLE 3

EXAMPLE 4

EXAMPLE 5

EXAMPLE 6

EXAMPLE 7

EXAMPLE 8

EXAMPLE 9

PARAMETERS

-BackupToKeyVault

-DeviceID

-DeviceName

-IncludeHistory

-KeyVaultName

-RunFromAzureAutomation

-ShowPassword

CommonParameters

INPUTS

OUTPUTS

NOTES

RELATED LINKS