How it works

What you need

• Microsoft Entra ID and Microsoft Intune. LAPSlock reads device inventory from Intune and credentials from Entra.
• Windows LAPS configured to back up to Microsoft Entra ID. This is the part most worth checking first — see the limits section below.
• An Entra role that can read local administrator passwords. Cloud Device Administrator is the least-privileged one that can. Intune Administrator, Security Administrator, Security Reader and Global Administrator also work.
• An iPhone running iOS 17 or later, with Face ID, Touch ID or a passcode set.

Using it

1. Sign in with Microsoft

   The normal sign-in for your organization, including Conditional Access, MFA and anything else your tenant enforces. LAPSlock has no account system and no password of its own. The first sign-in requests read-only permissions and nothing more; anything heavier is asked for later, only if you use the feature that needs it.

2. Find the device

   Search by device name, the person who uses it, serial number or model. Searching matches on the primary user's name and email address as well as the hostname, because a ticket usually names a person rather than a machine. Pin the devices you return to often, and the last few you opened appear on their own.

3. Reveal the password

   Face ID or Touch ID runs before the request goes to Microsoft, so an abandoned reveal creates no audit event in your tenant. The password appears for sixty seconds and is then wiped from memory. It never appears in the app switcher, a screenshot revokes it immediately, and copying it puts a self-expiring entry on the clipboard that is kept off Universal Clipboard.

4. BitLocker recovery keys, and older passwords

   Recovery keys for a device are listed by volume with the first characters of each key identifier, so you can match the key the locked machine is asking for rather than guessing. Where your tenant has kept previous LAPS passwords, those are available too — which matters when a device stopped checking in and is still using an older one.

5. Activate a role, if you need one

   If your access is PIM-eligible rather than active, LAPSlock can request activation without you leaving the bench. It reads your organization's own PIM policy first, so it offers only the durations your policy permits and tells you up front if a ticket number or additional verification is required.

6. Work across organizations

   Managed service providers can switch between customer tenants inside the app. Each switch is an explicit choice, the organization you are operating in is shown on screen at all times, and each customer's pinned devices stay with that customer.

Permissions, and when each one is requested

LAPSlock uses delegated permissions only. It never holds application permissions, so it has no standing access to your tenant and no ability to act while nobody is signed in. Permissions are requested in stages, so a first consent screen reads "reads device inventory" rather than "reads every password in your tenant".

What stays on your device

Passwords and recovery keys are held in memory only, for the length of the reveal window, and are overwritten when it ends. They are never written to disk, never included in an iPhone or iCloud backup, and never sent anywhere except between your device and Microsoft.

What LAPSlock does keep locally: your preferences, the device list for the current session, the identifiers of devices you pinned, and a count of how many free reveals you have used. That count lives on your device and on no server — a server-side counter would mean recording how often each organization retrieves passwords, which is exactly the thing this app is built not to do.

Optionally, you can lock the whole app behind Face ID. That protects the device list itself, which is worth something to an attacker even with no password on screen.

Verify it rather than trust it

Three claims above are the ones that matter, and all three are checkable without taking our word for anything:

• LAPSlock talks to three hosts. Microsoft for sign-in, Microsoft Graph for your data, and — only after you activate an organization license — a Kainor endpoint that returns a licence token and receives no device data. Point a proxy at your phone and watch; the network transparency document walks through it in about ten minutes.
• The source is available to read. The repository is public, including the code that handles credentials. You are welcome to review it, and security teams are explicitly permitted to copy it for that purpose.
• The credential path is structurally isolated. The module that handles passwords cannot import the licensing code, the analytics code — there is none — or anything else. A build script enforces it, so it is a property of the code rather than a promise in a document.

What LAPSlock cannot do

Stated plainly, because finding out later is worse:

• Windows LAPS backed up to Active Directory is invisible to it. LAPSlock reads Entra-backed LAPS. Entra-joined and hybrid-joined devices are both fine provided the policy backs up to Entra ID — but a device whose policy targets Windows Server Active Directory instead cannot be read, because Microsoft exposes no API for it.
• macOS local administrator passwords cannot be revealed. Microsoft does not currently offer an API that returns them; Intune keeps them encrypted on its own service and only the admin center can display one. LAPSlock shows what metadata exists and hands off to the portal. If Microsoft ships an API, the app will use it.
• It cannot grant you access you do not have. No permission LAPSlock requests escalates your privileges. If your account cannot read a password, the answer is a role assignment in your tenant, not a setting in the app.
• It is not a Microsoft product and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation.

Free use and subscriptions

LAPSlock is free to download and free to use, with a limit on how many credentials you can reveal in a rolling thirty-day period. Everything else — searching, BitLocker keys, password history, copying, PIM activation, app lock — works on the free tier without restriction.

Subscriptions that remove the reveal limit are available inside the app, on the Settings screen. Organizations that would rather license the whole tenant can email us.

Getting help

Email connor@kainor.com. If something failed, Settings includes a diagnostics report you can send with it — it carries Microsoft error codes and request identifiers and is structurally incapable of containing a password, a recovery key, a device name or a user name. You can read the whole thing before you send it.