Retrieve available Entra LAPS password history with Get-LapsAADPassword.
Did you know Entra can return more than one backed-up LAPS password? :)
If you happen to do a lot of snapshots/reverts for testing like I do, it’s worth checking the available history.
My original post used a Graph one-liner. The documented Windows LAPS cmdlet handles retrieval without manually decoding passwords:
1Get-LapsAADPassword -DeviceIds '<DeviceId>' -IncludePasswords -IncludeHistory
Replace <DeviceId> with the device’s DeviceId, not its directory object ID. Device names also work, but duplicate names cause the cmdlet to fail. Using the ID avoids that ambiguity.
You need the Windows LAPS cmdlet, the Microsoft Graph PowerShell library, an authenticated Graph connection, and consent for DeviceLocalCredential.Read.All. Delegated password retrieval also needs an appropriate Entra role, such as Cloud Device Administrator or Intune Service Administrator. Looking up a device by name additionally requires Device.Read.All.
Passwords are returned as SecureString objects by default. Add -AsPlainText only when you need to view them, and keep that output out of transcripts, logs, and tickets.
-IncludeHistory returns older credentials available on the device object. It doesn’t promise complete history or a retention depth, so don’t rely on it to recover every snapshot.
Get-LapsAADPassword reference | Graph permissions and roles
Original posts: 9 May 2024 and original Graph command. Documentation checked 14 October 2026.