Temporary Access Pass
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 25df3dc · +2 −9 lines · also on GitHub
⋯ 144 unchanged lines
145145
146146
| Option | Process | Steps |
147147
|--------|---------|-------|
148
−| Two single-use TAPs | If your organization enforces single-use TAPs, and the overall device enrollment process takes longer than 10 minutes, users need to enter another TAP for passwordless credential registration. When users enter a single-use TAP to register a passwordless authentication method, the registration must be completed within 10 minutes of sign-in. This behavior is consistent across all new authentication method registrations that require multifactor authentication (MFA), including registrations initiated through [Security info](https://mysignins.microsoft.com/security-info). The 10-minute requirement relates to MFA enforcement during credential registration, but not TAP specifically. | The first single-use TAP is used to complete device enrollment. | The first single-use TAP is used to complete device enrollment. If the device enrollment process reaches the Windows Hello for Business registration step after more than 10 minutes, a second single-use TAP must be provided to register the credential.|
149
−| One multiuse TAP | If your organization enables multiuse TAPs, a user can sign in with a single TAP multiple times during its validity period. For example, a user can sign in with a single TAP multiple times for one hour. A multiuse TAP can simplify the end-user experience by reducing the need to distribute multiple passcodes. If you choose to enable multiuse TAPs, consider monitoring TAP usage to ensure it is not used more times than expected during its validity period. | A user can enter the same TAP once to enroll their device, and again to register Windows Hello for Business. The 10-minute MFA requirement effectively restarts when the user begins to register the new authentication method. The timer restart protects the device enrollment and authentication registration process from interruption. |
150
−
151
−| Option | Process | Steps |
152
−|--------|---------|-------|
153
−|Two single-use TAPs | If your organization enforces single-use TAPs, and the overall device enrollment process takes longer than 10 minutes, users need to enter another TAP for passwordless credential registration.<br>When users enter a single-use TAP to register a passwordless authentication method, the registration must be completed within 10 minutes of sign-in. This behavior is consistent across all new authentication method registrations that require multifactor authentication (MFA), including registrations initiated through [Security info](https://mysignins.microsoft.com/security-info). The 10-minute requirement relates to MFA enforcement during credential registration, but not TAP specifically. | The first single-use TAP is used to complete device enrollment. <br>- If the device enrollment process reaches the Windows Hello for Business registration step after more than 10 minutes, a second single-use TAP must be provided to complete the credential enrollment. |
154
−| One multiuse TAP | If your organization enables multiuse TAPs, a user can sign in with a single TAP multiple times during its validity period. For example, a user can sign in with a single TAP multiple times for one hour.| In this case:<br>
155
−- A user can enter the same TAP once to enroll their device, and again to register Windows Hello for Business.
156
−- The 10-minute MFA requirement effectively restarts when the user begins to register the new authentication method. The timer restart protects the device enrollment and authentication registration process from interruption.<br>A multiuse TAP can simplify the end-user experience by reducing the need to distribute multiple passcodes. If you choose to enable multiuse TAPs, consider monitoring TAP usage to ensure it is not used more times than expected during its validity period. |
148
+| Two single-use TAPs | If your organization enforces single-use TAPs, and the overall device enrollment process takes longer than 10 minutes, users need to enter another TAP for passwordless credential registration. When users enter a single-use TAP to register a passwordless authentication method, the registration must be completed within 10 minutes of sign-in. This behavior is consistent across all new authentication method registrations that require multifactor authentication (MFA), including registrations initiated through [Security info](https://mysignins.microsoft.com/security-info). The 10-minute requirement relates to MFA enforcement during credential registration, but not TAP specifically. | The first single-use TAP is used to complete device enrollment. If the device enrollment process reaches the Windows Hello for Business registration step after more than 10 minutes, a second single-use TAP must be provided to register the credential.|
149
+| One multiuse TAP | If your organization enables multiuse TAPs, a user can sign in with a single TAP multiple times during its validity period. For example, a user can sign in with a single TAP multiple times for one hour. A multiuse TAP can simplify the end-user experience by reducing the need to distribute multiple passcodes. Monitor TAP usage to ensure it's not used more times than expected during its validity period. | A user can enter the same TAP once to enroll their device, and again to register Windows Hello for Business. The 10-minute MFA requirement effectively restarts when the user begins to register the new authentication method. The timer restart prevents interruption. |
157150
158151
### Windows device setup
159152
⋯ 91 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:02 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.