How LAPSlock was built
The architecture, authentication model, every Graph call, the on-device controls, a short threat model, and the dead ends behind an iOS app that reads Windows LAPS passwords and BitLocker keys from Entra ID and Intune with no server in the credential path. Including the PIM claims challenge that arrives as an HTTP 400, and why macOS passwords cannot be retrieved by any Graph API today.