Managing macOS devices using Microsoft Intune
Is there a supported Graph API that returns the macOS LAPS local admin password? The only macOS function returns rotation metadata and 500s
I build tooling on Microsoft Graph for Intune tenants that use Windows LAPS and macOS LAPS, using delegated permissions and documented endpoints only. Disclosure: I'm the developer of a commercial admin app in this space. This question is about the API surface, not the app.
Windows LAPS works exactly as documented. GET /v1.0/directory/deviceLocalCredentials/{deviceId}?$select=credentials returns the current password and its history to an authorised caller.
macOS LAPS (Intune service release 2507) appears to have no equivalent:
- The only macOS-specific function,
GET /beta/deviceManagement/managedDevices/{managedDeviceId}/retrieveDeviceLocalAdminAccountDetail, is documented to return amicrosoft.graph.macOSDeviceLocalAdminAccountDetailwith a single property,passwordLastRotationDateTime. There is no password property in the contract. Reference: https://learn.microsoft.com/en-us/graph/api/intune-devices-manageddevice-retrievedevicelocaladminaccountdetail?view=graph-rest-beta -
deviceLocalCredentials/{deviceId}?$select=credentialsreturns200 OKwith nocredentialsproperty for ADE-enrolled Macs. That's consistent with the macOS LAPS docs saying the password is "stored and encrypted by Intune" rather than in the Entra device store, so I don't think it's a defect, just confirmation that the Windows path doesn't apply. - In practice I've also seen the beta function return
500 Internal Server Errorconsistently for ADE-enrolled, LAPS-managed Macs, while the same signed-in user can view the password in the admin center for the same device. I can't reproduce that in my own tenant today because it has no ADE-enrolled Mac, so I'm not asking for it to be debugged here; I mention it in case it's a known issue.
The admin center can display and rotate these passwords (custom RBAC: View macOS admin password and Rotate macOS admin password under Enrollment programs), so the capability clearly exists server-side.
Questions
- Is there a supported Microsoft Graph API, now or on the roadmap, that returns the macOS LAPS local administrator password to an authorised delegated caller, the way
deviceLocalCredentialsdoes for Windows? - If there isn't and none is planned, could the
retrieveDeviceLocalAdminAccountDetailreference page say explicitly that the password value is not returned by any API? Admins searching for a macOS LAPS API find this function, assume it's the macOS counterpart of the Windows one, and only learn otherwise by calling it.
I'm not looking for an internal or undocumented endpoint and wouldn't build on one. I'm after the supported surface, or confirmation that there isn't one yet.