This example creates a new authorization rule, that allows all members of the `DOMAIN\AuthorizedLapsReaders` group to access the LAPS password for all devices in the AMS group named `My devices`, and expires the LAPS password after one hour.
This example creates a new authorization rule, that allows all members of the `DOMAIN\AuthorizedLapsReaders` group to access the LAPS password for all devices in the specified Microsoft Entra tenant, and specifies that the user must provide a reason when requesting access to the LAPS password
This example creates a new authorization rule, that allows all members of the `DOMAIN\AuthorizedLapsReaders` group to access the LAPS password for all devices in the specified Active Directory OU. It also specifies the audit channels to notify on the event a user triggers this rule.
This example creates a new authorization rule, that allows all members of the `DOMAIN\FinanceAdmins` group to JIT into the servers contained within the `FinanceServers` group. The rule is set to expire on 1st March 2025
PARAMETERS
-AadComputerId
The object ID of a Microsoft Entra computer
Type:StringParameter Sets:Microsoft Entra computer target authorized by ACL, Microsoft Entra computer target authorized by scriptAliases:Required:TruePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-AadGroupId
The object ID of a Microsoft Entra group
Type:StringParameter Sets:Microsoft Entra group target authorized by ACL, Microsoft Entra group target authorized by scriptAliases:Required:TruePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-AadTenantId
The tenant ID of a registered Microsoft Entra tenant
Type:StringParameter Sets: Microsoft Entra tenant target authorized by ACL, Microsoft Entra tenant target authorized by script, Microsoft Entra group target authorized by ACL, Microsoft Entra group target authorized by script, Microsoft Entra computer target authorized by ACL, Microsoft Entra computer target authorized by script
Aliases:Required:TruePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-AdComputer
The fully qualified name or SID of an Active Directory computer
Type:StringParameter Sets:AD computer target authorized by ACL, AD computer target authorized by scriptAliases:Required:TruePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-AdContainer
The DN of an Active Directory container object such as an organizational unit
Type:StringParameter Sets:AD container target authorized by ACL, AD container target authorized by scriptAliases:Required:TruePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-AdGroup
The fully qualified name or SID of an Active Directory group
Type:StringParameter Sets:AD group target authorized by ACL, AD group target authorized by scriptAliases:Required:TruePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-AmsComputerId
The object ID of an AMS-registered computer
Type:StringParameter Sets:AMS computer target authorized by ACL, AMS computer target authorized by scriptAliases:Required:TruePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-AmsGroupId
The SID of an AMS group
Type:StringParameter Sets:AMS group target authorized by ACL, AMS group target authorized by scriptAliases:Required:TruePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-AuthorizationScriptPath
The path to the authorization script to import
Type:StringParameter Sets: Microsoft Entra tenant target authorized by script, Microsoft Entra group target authorized by script, Microsoft Entra computer target authorized by script, AD computer target authorized by script, AD group target authorized by script, AD container target authorized by script, AMS computer target authorized by script, AMS group target authorized by script
Aliases:Required:TruePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
Specifies if the user is allowed to extend their JIT access request before it expires
Type:SwitchParameterParameter Sets: AD computer target authorized by ACL, AD computer target authorized by script, AD group target authorized by ACL, AD group target authorized by script, AD container target authorized by ACL, AD container target authorized by script
Aliases:Required:FalsePosition:NamedDefault value:FalseAccept pipeline input:FalseAccept wildcard characters:False
-JitGroupName
The name of the group that users will be added to when granted access to this role
Type:StringParameter Sets: AD computer target authorized by ACL, AD computer target authorized by script, AD group target authorized by ACL, AD group target authorized by script, AD container target authorized by ACL, AD container target authorized by script
Aliases:Required:FalsePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-JitMaximumAccessDuration
The maximum amount of time the user can request access to this computer via JIT
Type:TimeSpanParameter Sets: AD computer target authorized by ACL, AD computer target authorized by script, AD group target authorized by ACL, AD group target authorized by script, AD container target authorized by ACL, AD container target authorized by script
Aliases:Required:FalsePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-LapsAllowExtension
Specifies if the user is allowed to extend their LAPS access request before it expires
The list of principals who are allowed BitLocker access to this computer.
Type:Object[]Parameter Sets: Microsoft Entra tenant target authorized by ACL, Microsoft Entra group target authorized by ACL, Microsoft Entra computer target authorized by ACL, AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL, AMS computer target authorized by ACL, AMS group target authorized by ACL
Aliases:Required:FalsePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-PrincipalsAllowedJit
The list of principals who are allowed JIT access to this computer.
Type:Object[]Parameter Sets: AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL
Aliases:Required:FalsePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-PrincipalsAllowedLaps
The list of principals who are allowed LAPS access to this computer.
Type:Object[]Parameter Sets: Microsoft Entra tenant target authorized by ACL, Microsoft Entra group target authorized by ACL, Microsoft Entra computer target authorized by ACL, AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL, AMS computer target authorized by ACL, AMS group target authorized by ACL
Aliases:Required:FalsePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-PrincipalsAllowedLapsHistory
The list of principals who are allowed LAPS history access to this computer.
Type:Object[]Parameter Sets: Microsoft Entra tenant target authorized by ACL, Microsoft Entra group target authorized by ACL, Microsoft Entra computer target authorized by ACL, AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL, AMS computer target authorized by ACL, AMS group target authorized by ACL
Aliases:Required:FalsePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-PrincipalsDeniedBitLocker
The list of principals who are not allowed BitLocker access to this computer.
Type:Object[]Parameter Sets: Microsoft Entra tenant target authorized by ACL, Microsoft Entra group target authorized by ACL, Microsoft Entra computer target authorized by ACL, AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL, AMS computer target authorized by ACL, AMS group target authorized by ACL
Aliases:Required:FalsePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-PrincipalsDeniedJit
The list of principals who are not allowed JIT access to this computer.
Type:Object[]Parameter Sets: AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL
Aliases:Required:FalsePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-PrincipalsDeniedLaps
The list of principals who are not allowed LAPS access to this computer.
Type:Object[]Parameter Sets: Microsoft Entra tenant target authorized by ACL, Microsoft Entra group target authorized by ACL, Microsoft Entra computer target authorized by ACL, AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL, AMS computer target authorized by ACL, AMS group target authorized by ACL
Aliases:Required:FalsePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-PrincipalsDeniedLapsHistory
The list of principals who are not allowed LAPS history access to this computer.
Type:Object[]Parameter Sets: Microsoft Entra tenant target authorized by ACL, Microsoft Entra group target authorized by ACL, Microsoft Entra computer target authorized by ACL, AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL, AMS computer target authorized by ACL, AMS group target authorized by ACL
Aliases:Required:FalsePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-RuleExpiryDate
A date and time when this rule will expire, expressed in local time
The name of a domain controller to use when performing the JIT operation against
Type:StringParameter Sets: AD computer target authorized by ACL, AD computer target authorized by script, AD group target authorized by ACL, AD group target authorized by script, AD container target authorized by ACL, AD container target authorized by script
Aliases:Required:FalsePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-DoNotUseRemoteDcLocator
Specifies that the AMS service should not attempt to use the target computer's DCLocator service to find a domain controller to perform the JIT operation against
Type:SwitchParameterParameter Sets: AD computer target authorized by ACL, AD computer target authorized by script, AD group target authorized by ACL, AD group target authorized by script, AD container target authorized by ACL, AD container target authorized by script
Aliases:Required:FalsePosition:NamedDefault value:FalseAccept pipeline input:FalseAccept wildcard characters:False
-SiteName
The name of the site to use when trying to find a domain controller to perform the JIT operation against
Type:StringParameter Sets: AD computer target authorized by ACL, AD computer target authorized by script, AD group target authorized by ACL, AD group target authorized by script, AD container target authorized by ACL, AD container target authorized by script
Aliases:Required:FalsePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-PrincipalsAllowedRapidLapsElevation
The list of principals who are allowed RapidLAPS elevation access to this computer.
Type:Object[]Parameter Sets: Microsoft Entra tenant target authorized by ACL, Microsoft Entra group target authorized by ACL, Microsoft Entra computer target authorized by ACL, AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL, AMS computer target authorized by ACL, AMS group target authorized by ACL
Aliases:Required:FalsePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-PrincipalsAllowedRapidLapsLogin
The list of principals who are allowed RapidLAPS login access to this computer.
Type:Object[]Parameter Sets: Microsoft Entra tenant target authorized by ACL, Microsoft Entra group target authorized by ACL, Microsoft Entra computer target authorized by ACL, AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL, AMS computer target authorized by ACL, AMS group target authorized by ACL
Aliases:Required:FalsePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-PrincipalsDeniedRapidLapsElevation
The list of principals who are not allowed RapidLAPS elevation access to this computer.
Type:Object[]Parameter Sets: Microsoft Entra tenant target authorized by ACL, Microsoft Entra group target authorized by ACL, Microsoft Entra computer target authorized by ACL, AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL, AMS computer target authorized by ACL, AMS group target authorized by ACL
Aliases:Required:FalsePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
-PrincipalsDeniedRapidLapsLogin
The list of principals who are not allowed RapidLAPS login access to this computer.
Type:Object[]Parameter Sets: Microsoft Entra tenant target authorized by ACL, Microsoft Entra group target authorized by ACL, Microsoft Entra computer target authorized by ACL, AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL, AMS computer target authorized by ACL, AMS group target authorized by ACL
Aliases:Required:FalsePosition:NamedDefault value:NoneAccept pipeline input:FalseAccept wildcard characters:False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.