LAPS secures IT's admin account.
In Intune
Set in the automated device enrollment (ADE) profile. It creates a local admin account with a random 15-character password that Intune stores and rotates at least every six months. The person's own account can be created as a standard user. It applies to new enrollments only, so a Mac that's already enrolled has to be erased and enrolled again.
In Jamf Pro
The managed local administrator account created during a PreStage enrollment. Jamf Pro stores and rotates its password. It covers the account made at enrollment, not one you create later.
What it leaves open
Once everyone works as a standard user, people still need admin now and then: a printer driver, an Xcode update. LAPS has no answer for that, short of handing over IT's password.
Three tools, three jobs.
| Question | macOS LAPS | SAP Privileges | Altiward |
|---|---|---|---|
| Who holds admin | IT, through one managed account | The person at the Mac, for a set time | Leaves granting to SAP Privileges and watches everyone who holds admin |
| What it does | Stores and rotates the admin account's password | Grants admin on request, with a timer and a reason | Checks that admin rights end, removes them when they don't, and records every session |
| When admin ends | When IT signs out | When the timer runs out, unless someone stops it | When the grant expires, even if the timer was stopped |
| Admin nobody granted | Not covered | Not covered | Flagged, with a finding sent to your SIEM |
| The record | Intune's audit log shows who viewed or rotated the password | Can send each change to syslog or a webhook | Who, on which Mac, the reason, and how it ended, sent to Splunk, Microsoft Sentinel or syslog |
Keep LAPS, add temporary admin, and check both.
Keep LAPS for IT's account
Leave the LAPS account to Intune or Jamf Pro. Give it a fixed name, such as Intune's default Admin, so it's easy to list.
Give people temporary admin with SAP Privileges
Everyone else works as a standard user and asks SAP Privileges for admin when they need it, with a reason.
Tell Altiward which accounts are managed
List the LAPS account in Altiward's configuration profile. Altiward leaves it alone and watches every other admin.
What Altiward does with your LAPS account.
- Leaves it alone
- Accounts listed as permanent admins are never flagged as admin without a grant, and their rights are never removed.
- Watches everyone else
- Every other account in the admin group is checked. An admin account made on the side is still flagged as admin rights nobody granted.
- Set through your MDM
- The list comes from the configuration profile you deploy with your MDM. If someone changes it on the Mac outside your MDM, Altiward reports it as tampering.
- Who used the LAPS account
- That stays with your MDM. In Intune, the audit log records each time someone views or rotates the password.
What Mac admins ask.
Does Intune support LAPS on macOS?
Yes, for Macs that enroll through automated device enrollment with a LAPS-enabled profile, after a factory reset. Macs enrolled before then need to be erased and enrolled again. Microsoft's guide: set up local admin account creation and password management for macOS.
Does Intune Endpoint Privilege Management work on Mac?
No. As of October 2026, Microsoft lists Endpoint Privilege Management as Windows only. On Intune-managed Macs, SAP Privileges gives people temporary admin, and Altiward makes sure it ends.
Does LAPS remove admin rights from users?
Not by itself. Intune's enrollment profile can create the person's account as a standard user, but LAPS manages only IT's admin account. It doesn't notice admin rights given to anyone else later.
Will Altiward flag our LAPS account?
Not once it's listed as a permanent admin. Until then, it's flagged like any other admin nobody granted.
Altiward is in early access.
Early access is for Mac teams who already deploy SAP Privileges through an MDM such as Jamf or Intune.