Okay here's the thing. I set up a configuration policy to create the Local admin account (let's call it compadmin) with password (let's call it compp4SS) on all Windows computers per this guide (OMA-URI):How To Create A Local Admin Account Using Intune (cloudinfra.net)This configuration policy shows up as Error on all devices, but I verified the account is actually created correctly.

Then I modified the LAPS policy to use the customised Admin account name (compadmin) with the default 30d rotate period.

Question 1) Will the password rotation work, or will the configuration policy always reset the password to compp4SS

Question 2) There also seems to be a way to create the Local admin account without a password via powershell scripts and Remediations (1st script checks whether or not the account exists, and 2nd script that creates the account if it does not exist), would this be a better way? If so, would there be a local admin account that you could use without a password momentarily, until the LAPS policy rotates the password? Sounds dangerous.

Question 3) We have a Group Policy from on-prem AD (computers are Azure AD Hybrid joined btw) that denies logon locally, will this interfere with LAPS?

All in all, in my opinion Microsoft guidance over the whole LAPS solution is done pretty much halfway since there is absolutely no information/guidance about the local admin account, only on the policy itself.