Gets the Windows Local Administrator Password Solution (LAPS) password for one or all devices in Microsoft Entra ID (formerly Azure AD).
By default, only metadata is returned (no password).
Use -ShowPassword to retrieve the password in plain text.
Passwords can optionally be backed up to an Azure Key Vault.
Filter results to a specific device by its Entra ID (Azure AD) object ID.
If not specified, retrieves LAPS passwords for all devices.
Cannot be used together with DeviceName parameter.
Retrieve and display the LAPS password in plain text.
By default, only metadata (expiration time, etc.) is returned.
Use with caution, as this will expose the password in the console output.
Include previous LAPS passwords in the output, in addition to the current one.
Only applicable when -ShowPassword or -BackupToKeyVault is specified.
Has no effect otherwise.
The output includes an IsCurrent property to identify the active password.
Use managed identity authentication instead of interactive authentication.
Suitable for Azure Automation runbooks, Azure Functions, or VMs with managed identity enabled.
Enable backup of LAPS passwords to Azure Key Vault.
Must be used together with -KeyVaultName.
The secret name is the device name; the Content Type field contains the account name and backup date.
Name of the Azure Key Vault to back up LAPS passwords to.
Mandatory when -BackupToKeyVault is specified.
Requires the Az.KeyVault module and appropriate permissions.
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
