Temporary Access Pass
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 86c2533 · +2 −7 lines · also on GitHub
⋯ 144 unchanged lines
145145
146146
| Option | Process description | Steps |
147147
|:--------:|:--------------------|:--------|
148
−| Two single-use TAPs | If your organization enforces single-use TAPs, and the overall device enrollment process takes longer than 10 minutes, users need to enter another TAP for passwordless credential registration. When users enter a single-use TAP to register a passwordless authentication method, the registration must be completed within 10 minutes of sign-in.
149
−<br>This behavior is consistent across all new authentication method registrations that require multifactor authentication (MFA), including registrations initiated through [Security info](https://mysignins.microsoft.com/security-info).
150
−<br>The 10-minute requirement relates to MFA enforcement during credential registration, but not TAP specifically. | - The first single-use TAP is used to complete device enrollment.
151
−<br>- If the device enrollment process reaches the Windows Hello for Business registration step after more than 10 minutes, a second single-use TAP must be provided to register the credential.|
152
−| One multiuse TAP | If your organization enables multiuse TAPs, a user can sign in with a single TAP multiple times during its validity period. For example, a user can sign in with a single TAP multiple times for one hour.
153
−<br>A multiuse TAP can simplify the end-user experience by reducing the need to distribute multiple passcodes. Monitor TAP usage to ensure it's not used more times than expected during its validity period. | - A user can enter the same TAP once to enroll their device, and again to register Windows Hello for Business.
154
−<br>- The 10-minute MFA requirement effectively restarts when the user begins to register the new authentication method. The timer restart prevents interruption for device setup. |
148
+| Two single-use TAPs | If your organization enforces single-use TAPs, and the overall device enrollment process takes longer than 10 minutes, users need to enter another TAP for passwordless credential registration. When users enter a single-use TAP to register a passwordless authentication method, the registration must be completed within 10 minutes of sign-in. <br>This behavior is consistent across all new authentication method registrations that require multifactor authentication (MFA), including registrations initiated through [Security info](https://mysignins.microsoft.com/security-info). The 10-minute requirement relates to MFA enforcement during credential registration, but not TAP specifically. | The first single-use TAP is used to complete device enrollment. If the device enrollment process reaches the Windows Hello for Business registration step after more than 10 minutes, a second single-use TAP must be provided to register the credential.|
149
+| One multiuse TAP | If your organization enables multiuse TAPs, a user can sign in with a single TAP multiple times during its validity period. For example, a user can sign in with a single TAP multiple times for one hour. A multiuse TAP can simplify the end-user experience by reducing the need to distribute multiple passcodes. Monitor TAP usage to ensure it's not used more times than expected during its validity period. | A user can enter the same TAP once to enroll their device, and again to register Windows Hello for Business. The 10-minute MFA requirement effectively restarts when the user begins to register the new authentication method. The timer restart prevents interruption for device setup. |
155150
156151
### Windows device setup
157152
⋯ 91 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:02 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.