Enabling LAPS in the Jamf Pro API

Technical Paper: Local Administrator Password Solution for Jamf Pro
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

The following instructions describe how to enable MDM LAPS, turn on automatic password rotation, and configure rotation frequency and expiration in the Jamf Pro API.

  1. In the Jamf Pro API, click local-admin password to view its endpoints, and then click the PUT /v2/local-admin-password/settings endpoint.
  2. Click Try It Out.

    The current settings are displayed. Below are the default settings:

    {
"autoDeployEnabled": false,
"passwordRotationTime": 3600,
"autoRotateEnabled"; false,
"autoRotateExpirationTime" 7776000
}

    • Jamf management framework LAPS is enabled by default and always on, even though autoDeployEnabled is set to false. (The autoDeployEnabled setting only applies to the MDM LAPS.)

    • MDM LAPS is disabled by default (autoDeployEnabled is set to false).

    Using the default settings, passwords are rotated once every three months (autoRotateExpirationTime is set to 7776000 seconds). LAPS will rotate the passwords automatically one hour after they have been viewed (passwordRotationTime is set to 3600 seconds).

  3. Set autoDeployEnabled to true to enable MDM LAPS.
  4. Set autoRotateEnabled to true to enable automatic password rotation.
    Note:

    This setting does not apply to passwordRotationTime. By default, passwords will rotate after they are viewed even if autoRotateEnabled is set to false.

  5. (Optional) Adjust the frequency of the passwordRotationTime and autoRotateExpirationTime by entering new values in seconds.
  6. Click Execute.

Both Jamf management framework LAPS and MDM LAPS are now enabled and ready to be applied to enrolled computers.