LAPSlock: LAPS passwords on your phone
An iOS app for viewing Windows and macOS local administrator passwords managed by Microsoft Entra ID and Intune. Built for helpdesk benches, server rooms, and everywhere else the admin console isn't.
Search a device by name, activate your role, read the password, rotate it when you're done. That's the whole app, and that's the point. No dashboards to babysit, no agent to deploy, no new place for local admin credentials to live.
LAPSlock talks directly to Microsoft Graph using delegated sign-in. Retrieval works only for admins who already hold the right role in their own tenant, and every retrieval lands in that tenant's audit log, exactly as if it happened from the admin portal.
The client source is published for review, because software that handles local admin passwords shouldn't ask for blind trust.
Sign in with your work account
Your tenant issues the token. Your Conditional Access policies decide the terms.
Activate your role
Microsoft Graph enforces role checks server-side. No role, no password. PIM just-in-time activation fits right in.
Retrieve over TLS
The password travels from Microsoft's API to your phone. It is never stored, proxied, or logged along the way.
Rotate after use
One tap queues rotation, and the audit trail in your tenant shows who read what, and when.
Rules of the garage
Local admin passwords are break-glass credentials. Tooling that touches them should be boring, inspectable, and structurally unable to betray you.
There is no Kainor server
Credentials travel from Microsoft Graph to your device and nowhere else. We can't leak what we never see.
The app owns no access
Every request runs as the signed-in admin, inside their tenant's rules. No app-only permissions, no standing secrets.
Your tenant stays in charge
Conditional Access, role activation, and audit logging all apply on every retrieval, because retrieval happens in your tenant.
Read it before you trust it
The client code is public on GitHub for security review, including by commercial organizations. The permission scopes we request are documented, each with a reason attached.
Built on shift
Kainor LLC is an independent software vendor and technology consultancy in Spring Hill, Kansas, founded in 2026 by a working systems administrator and CISSP.
We build for the Microsoft identity and endpoint stack because it's the world we operate in every day: Entra ID, Intune, Conditional Access, and the small gaps between them where real admin work gets stuck. Our products start as tools we wished we had on shift.
Security review, IT consulting, and custom tooling inquiries are welcome by email.