I'm building a disaster-recovery plan for a Microsoft tenant deauthentication or outage. The difficult case is Entra-joined, Intune-managed workstations: if normal workstation sign-ins stop working and Intune is unavailable, we may not be able to retrieve the LAPS password. What recovery approach would you recommend, and how long can users continue signing in with cached credentials while the device is offline?
2 Answers
Have a tested local recovery administrator account that does not depend on Entra ID, Intune, or a live network connection. That account should be tightly controlled, audited, protected with a strong unique credential, and included in your break-glass procedures. If the password is managed through LAPS, make sure you also have a secure emergency retrieval or rotation process that remains available during a tenant outage.
It can if it’s unmanaged or permanently enabled. The goal is a controlled fallback: use a unique password per device, restrict and monitor the account, document who can access it, and test the process regularly. LAPS remains preferable for normal operations, but recovery needs a path that doesn’t rely on the failed service.
Users who have previously signed in may still be able to use cached sign-in data, but you shouldn’t treat that as a guaranteed recovery method. Its usefulness depends on the account, device state, token validity, policy settings, and whether the user has already signed in on that workstation. Test the exact failure scenario in your environment rather than assuming a fixed number of days.
Wouldn’t keeping a standing local admin account undermine the security benefits of LAPS?