LAPSlock
LAPS passwords and BitLocker recovery keys on the phone admins carry, through Entra ID and Intune. No Kainor server.
How LAPSlock works
Products
Available on the App Store
Available
In development
Three tools for Microsoft-first teams
TenantKeep Posture
A read-only collection from your Microsoft 365 tenant becomes a branded security posture report with a risk register, Copilot readiness and Conditional Access documented and diffed. Nothing leaves your tenant.
tenantkeep.appTenantKeep On-Call
The on-call companion for the people who answer the phone when something breaks in Microsoft 365.
Details when it ships
First product
LAPSlock: LAPS passwords on your phone
An iOS app for viewing Windows LAPS local administrator passwords and BitLocker recovery keys managed by Microsoft Entra ID and Intune. For macOS it shows rotation status; Microsoft offers no API that returns the password. Built for helpdesk benches, server rooms, and everywhere else the admin console isn't.
Available now on the App Store
Search a device by name, activate your role, read the password, rotate it when you're done. That's the whole app, and that's the point. No dashboards to babysit, no agent to deploy, no new place for local admin credentials to live.
LAPSlock talks directly to Microsoft Graph using delegated sign-in. Retrieval works only for admins who already hold the right role in their own tenant, and every retrieval lands in that tenant's audit log, exactly as if it happened from the admin portal.
The client source is published for review, because software that handles local admin passwords shouldn't ask for blind trust.
Sign in with your work account
Your tenant issues the token. Your Conditional Access policies decide the terms.
Activate your role
Microsoft Graph enforces role checks server-side. No role, no password. PIM just-in-time activation fits right in.
Retrieve over TLS
The password travels from Microsoft's API to your phone. It is never stored, proxied, or logged along the way.
Rotate after use
One tap queues rotation, and the audit trail in your tenant shows who read what, and when.
How we build
Rules of the garage
Local admin passwords are break-glass credentials. Tooling that touches them should be boring, inspectable, and structurally unable to betray you.
01 · No backend
There is no Kainor server
Credentials travel from Microsoft Graph to your device and nowhere else. We can't leak what we never see.
02 · Delegated only
The app owns no access
Every request runs as the signed-in admin, inside their tenant's rules. No app-only permissions, no standing secrets.
03 · Your controls rule
Your tenant stays in charge
Conditional Access, role activation, and audit logging all apply on every retrieval, because retrieval happens in your tenant.
04 · Source published
Read it before you trust it
The client code is public on GitHub for security review, including by commercial organizations. The permission scopes we request are documented, each with a reason attached.
About
Built on shift
Kainor LLC is an independent software vendor and technology consultancy in Spring Hill, Kansas, founded in 2026 by a working systems administrator and CISSP.
We build for the Microsoft identity and endpoint stack because it's the world we operate in every day: Entra ID, Intune, Conditional Access, and the small gaps between them where real admin work gets stuck. Our products start as tools we wished we had on shift.
Security review, IT consulting, and custom tooling inquiries are welcome by email.