Temporary Access Pass

This page's changes and edits · All guidance changes

Microsoft's edit · 10 Feb 18:10 UTC

Update howto-authentication-temporary-access-pass.md

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 8fde1ca · +24 −6 lines · also on GitHub

⋯ 3 unchanged lines

44 ms.service: entra-id

55 ms.subservice: authentication

66 ms.topic: how-to

7 −ms.date: 03/04/2025

7 +ms.date: 02/10/2026

88 ms.author: justinha

99 author: tilarso

1010 manager: dougeby

⋯ 101 unchanged lines

112112

113113 ```

114114

115 −For more information, see [New-MgUserAuthenticationTemporaryAccessPassMethod](/powershell/module/microsoft.graph.identity.signins/new-mguserauthenticationtemporaryaccesspassmethod) and [Get-MgUserAuthenticationTemporaryAccessPassMethod](/powershell/module/microsoft.graph.identity.signins/get-mguserauthenticationtemporaryaccesspassmethod?view=graph-powershell-1.0&preserve-view=true&viewFallbackFrom=graph-powershell-beta).

115 +For more information, see [New-MgUserAuthenticationTemporaryAccessPassMethod](/powershell/module/microsoft.graph.identity.signins/new-mguserauthenticationtemporaryaccesspassmethod) and [Get-MgUserAuthenticationTemporaryAccessPassMethod](/powershell/module/microsoft.graph.identity.signins/get-mguserauthenticationtemporaryaccesspassmethod).

116116

117117 ## Use a Temporary Access Pass

118118

119 −The most common use for a TAP is for a user to register authentication details during the first sign-in or device setup, without the need to complete extra security prompts. Authentication methods are registered at [https://aka.ms/mysecurityinfo](https://aka.ms/mysecurityinfo). Users can also update existing authentication methods here.

119 +The most common use for a TAP is for a user to register authentication details during the first sign-in or device setup, without the need to complete extra security prompts. Authentication methods are registered at [Security info](https://mysignins.microsoft.com/security-info). Users can also update existing authentication methods here.

120120

121 −1. Open a web browser to [https://aka.ms/mysecurityinfo](https://aka.ms/mysecurityinfo).

121 +1. Open a web browser to [Security info](https://mysignins.microsoft.com/security-info).

122122 1. Enter the UPN of the account you created the TAP for, such as *[email protected]*.

123123 1. If the user is included in the TAP policy, they see a screen to enter their TAP.

124124 1. Enter the TAP that was displayed in the Microsoft Entra admin center.

⋯ 9 unchanged lines

134134

135135 ### User management of Temporary Access Pass

136136

137 −Users managing their security information at [https://aka.ms/mysecurityinfo](https://aka.ms/mysecurityinfo) see an entry for the Temporary Access Pass. If a user doesn't have any other registered methods, they get a banner at the top of the screen that says to add a new sign-in method. Users can also see the TAP expiration time, and delete the TAP if it's no longer needed.

137 +Users managing their [Security info](https://mysignins.microsoft.com/security-info) see an entry for the Temporary Access Pass. If a user doesn't have any other registered methods, they get a banner at the top of the screen that says to add a new sign-in method. Users can also see the TAP expiration time, and delete the TAP if it's no longer needed.

138138

139139 :::image type="content" border="true" source="./media/how-to-authentication-temporary-access-pass/tap-my-security-info.png" alt-text="Screenshot of how users can manage a Temporary Access Pass in My Security Info..":::

140140

141 +### Device enrollemnt and passwordless registration

142 +

143 +When using a Temporary Access Pass (TAP) to support device enrollment and passwordless credential registration (for example, Windows Hello for Business), there are two supported approaches to ensure a smooth end-user experience.

144 +

145 +Option | Process | Steps

146 +-------|---------|------

147 +Two single-use TAPs | If your organization enforces single-use TAPs, and the overall device enrollment process takes longer than 10 minutes, users need to enter another TAP for passwordless credential registration.

148 +When users enter a single-use TAP to register a passwordless authentication method, the registration must be completed within 10 minutes of sign-in. This behavior is consistent across all new authentication method registrations that require multifactor authentication (MFA), including registrations initiated through [Security info](https://mysignins.microsoft.com/security-info). The 10-minute requirement relates to MFA enforcement during credential registration, but not TAP specifically.|

149 +In this scenario:

150 +- The first single-use TAP is used to complete device enrollment.

151 +- If the device enrollment process reaches the Windows Hello for Business registration step after more than 10 minutes, a second single-use TAP must be provided to complete the credential enrollment. |

152 +One multiuse TAP | If your organization enables multiuse TAPs, a user can sign in with a single TAP multiple times during its validity period. For example, a user can sign in with a single TAP multiple times for one hour.|

153 +In this case:

154 +- A user can enter the same TAP once to enroll their device, and again to register Windows Hello for Business.

155 +- The 10-minute MFA requirement effectively restarts when the user begins to register the new authentication method. The timer restart protects the device enrollemnt and authentication registration process from interruption.

156 +A multiuse TAP can simplify the end-user experience by reducing the need to distribute multiple passcodes. If you choose to enable multiuse TAPs, consider monitoring TAP usage to ensure it is not used more times than expected during its validity period. |

157 +

141158 ### Windows device setup

142159

143160 Users with a TAP can navigate the setup process on Windows 10 and 11 to perform device join operations and configure Windows Hello for Business. TAP usage for setting up Windows Hello for Business varies based on the devices joined state.

⋯ 4 unchanged lines

148165 - If the [Web sign-in](/windows/client-management/mdm/policy-csp-authentication#authentication-enablewebsignin) feature on Windows is also enabled, the user can use TAP to sign into the device. This is intended only for completing initial device setup, or recovery when the user doesn't know or have a password.

149166

150167 For hybrid-joined devices, users must first authenticate with another method such as a password, smartcard or FIDO2 key, before using TAP to set up Windows Hello for Business.

168 +

151169 > [!NOTE]

152170 > For federated domains, the **FederatedIdpMfaBehavior** changes the behavior when MFA is required. If set to **enforceMfaByFederatedIdp** the user is redirected to the federated IDP and does not get the chance to use the TAP. However, if set to **acceptIfMfaDoneByFederatedIdp** then the user will see a TAP prompt in Entra ID during MFA for Windows Hello for Business provisioning.

153171

⋯ 41 unchanged lines

195213 Remove-MgUserAuthenticationTemporaryAccessPassMethod -UserId [email protected] -TemporaryAccessPassAuthenticationMethodId 00aa00aa-bb11-cc22-dd33-44ee44ee44ee

196214 ```

197215

198 −For more information, see [Remove-MgUserAuthenticationTemporaryAccessPassMethod](/powershell/module/microsoft.graph.identity.signins/remove-mguserauthenticationtemporaryaccesspassmethod?view=graph-powershell-1.0&preserve-view=true&viewFallbackFrom=graph-powershell-beta).

216 +For more information, see [Remove-MgUserAuthenticationTemporaryAccessPassMethod](/powershell/module/microsoft.graph.identity.signins/remove-mguserauthenticationtemporaryaccesspassmethod).

199217

200218 ## Replace a Temporary Access Pass

201219

⋯ 31 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:02 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.