Is there a supported Graph API that returns the macOS LAPS local admin password? The only macOS function returns rotation metadata and 500s

Connor Johnson 0 Reputation points
2026-09-08T18:44:20.8966667+00:00

I build tooling on Microsoft Graph for Intune tenants that use Windows LAPS and macOS LAPS, using delegated permissions and documented endpoints only. Disclosure: I'm the developer of a commercial admin app in this space. This question is about the API surface, not the app.

Windows LAPS works exactly as documented. GET /v1.0/directory/deviceLocalCredentials/{deviceId}?$select=credentials returns the current password and its history to an authorised caller.

macOS LAPS (Intune service release 2507) appears to have no equivalent:

  1. The only macOS-specific function, GET /beta/deviceManagement/managedDevices/{managedDeviceId}/retrieveDeviceLocalAdminAccountDetail, is documented to return a microsoft.graph.macOSDeviceLocalAdminAccountDetail with a single property, passwordLastRotationDateTime. There is no password property in the contract. Reference: https://learn.microsoft.com/en-us/graph/api/intune-devices-manageddevice-retrievedevicelocaladminaccountdetail?view=graph-rest-beta
  2. deviceLocalCredentials/{deviceId}?$select=credentials returns 200 OK with no credentials property for ADE-enrolled Macs. That's consistent with the macOS LAPS docs saying the password is "stored and encrypted by Intune" rather than in the Entra device store, so I don't think it's a defect, just confirmation that the Windows path doesn't apply.
  3. In practice I've also seen the beta function return 500 Internal Server Error consistently for ADE-enrolled, LAPS-managed Macs, while the same signed-in user can view the password in the admin center for the same device. I can't reproduce that in my own tenant today because it has no ADE-enrolled Mac, so I'm not asking for it to be debugged here; I mention it in case it's a known issue.

The admin center can display and rotate these passwords (custom RBAC: View macOS admin password and Rotate macOS admin password under Enrollment programs), so the capability clearly exists server-side.

Questions

  1. Is there a supported Microsoft Graph API, now or on the roadmap, that returns the macOS LAPS local administrator password to an authorised delegated caller, the way deviceLocalCredentials does for Windows?
  2. If there isn't and none is planned, could the retrieveDeviceLocalAdminAccountDetail reference page say explicitly that the password value is not returned by any API? Admins searching for a macOS LAPS API find this function, assume it's the macOS counterpart of the Windows one, and only learn otherwise by calling it.

I'm not looking for an internal or undocumented endpoint and wouldn't build on one. I'm after the supported surface, or confirmation that there isn't one yet.

Microsoft Security | Intune | Microsoft Intune MacOs
0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.