Implement CIS 5.1.4.5 LAPS control

[AGAZ-04]

Summary

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactor / code cleanup
• Documentation
• CI/CD / infrastructure
• Security

Affected Components

• /backend-api
• /frontend
• /engine (collectors / policies)
• /security
• /infrastructure
• /.github/workflows
• /docs

Motivation

Testing Done

• Unit tests pass locally
• Tested manually — describe how: Rego policy was tested with compliant and non-compliant inputs using OPA. The existing entra.devices.device_registration_policy collector was also tested against the live Microsoft 365 tenant. The collector successfully returned the LAPS configuration, and the policy correctly evaluated the tenant configuration as non-compliant when laps_enabled was false.
• No tests required — explain why:

Security Considerations

Breaking Changes

• No breaking changes
• Yes — describe below:

Rollback Plan

• Revert commit is sufficient
• Requires additional steps — describe below:

Checklist

• Code follows project conventions
• No secrets, credentials, or tokens committed
• Relevant documentation updated (if applicable)
• CI/CD workflows pass on this branch
• PR is focused on one thing

Screenshots

[github-actions]

Preview Environment

A preview environment can be spun up on demand for this PR.

Action	Label	Includes
Spin up preview	deploy-preview	Frontend, backend, database, Redis, OPA, worker
Spin up preview with M365	deploy-preview-m365	Everything above + PowerShell service for Exchange/Teams scan testing
Tear down preview	teardown-preview	Stops the environment early

The environment will also be torn down automatically when the PR is closed or merged.
Preview URLs will appear in a follow-up comment once the deploy completes (~5–8 min).
M365 scans require real tenant credentials added through the frontend UI.

[github-actions]

CI: Engine

Job	Result
Security analysis (CodeQL)	✅ success
Lint	✅ success
Tests	✅ success

All checks passed.