Skip to content
Web App
5/6 checks passed

Windows LAPS Self‑Service Portal

Windows LAPS Self-Service Portal lets users securely retrieve the LAPS password for their own device without helpdesk tickets. Built on Azure Static Web Apps + Azure Functions and Entra ID, it enforces an only-my-device rule, requires a justification, and auto-hides the password after 60 seconds. Every access is auditable in Azure Table Storage, with a zero-stored-secrets design and Graph access via a Managed Identity.

Visit WebsiteView on GitHub

Screenshots

1 / 5

Swipe to see more

Security Analysis

5of 6
1 Issue Found

11 files scanned on Aug 16, 2026

Issues Detected
No Credential Theft
No token or credential harvesting code
LAPS passwords are retrieved from Microsoft Graph and returned in the API response after ownership validation. Passwords are decoded from base64 to plaintext and included in the response. While this is the intended feature, it represents a high-risk data exposure point if the API response, transport, or client security is compromised. Mitigations include strict RBAC, TLS (implied), minimizing exposure, and ensuring responses are only delivered to authorized users.
Passed Checks
No Obfuscated Code
No Remote Execution
No Data Exfiltration
No Malicious Patterns
No Hardcoded Secrets
AI Analysis

The Windows LAPS Self-Service Portal codebase adheres to expected patterns for an Intune/Graph-backed service, with no malicious patterns detected. The primary security consideration is the handling of LAPS passwords: they are retrieved and returned to authenticated users after ownership verification. This is by design but requires strong access controls, encrypted transport, and careful monitoring of telemetry/audit data to minimize exposure risk. No hardcoded secrets or obfuscated payloads were found beyond legitimate header decoding for Easy Auth.

You might also like

Web App

RepoFabric

RepoFabric is a self-hosted WinGet source platform for Microsoft-managed fleets. It provides Entra ID sign-in, one-click Intune policy export (DesktopAppInstaller CSP) to point endpoints to a private source, Azure Arc readiness, and a GUI admin console. It also offers a REST API and a 48-cmdlet PowerShell module, GitOps manifests, scheduled sync, and LAN peer-caching to reduce bandwidth.

Mark RingoMark Ringo
Web App

Intune Drive Mapping Generator

A web-based tool that generates PowerShell scripts for network drive mapping on Intune-managed Windows 10 devices. Converts existing Group Policy drive exports to Intune-compatible scripts, supports security group filtering with nested groups, and enables recurring execution.

Nicola SuterNicola Suter
Web App

IntuneAdminTemplateMigrator

Converts Administrative Template policies to Settings Catalog — reads your existing policies and creates the equivalent Settings Catalog profiles with the same settings and values.

J
Joery Van den Bosch
Web App

NukeTool

Reset your tenant.

jorgeasaurusjorgeasaurus