Temporary Access Pass

This page's changes and edits · All guidance changes

Microsoft's edit · 10 Feb 18:24 UTC

Fix wording and typos in TAP how-to doc

Microsoft's commit message in MicrosoftDocs/entra-docs · commit a8e5375 · +7 −7 lines · also on GitHub

⋯ 23 unchanged lines

2424

2525 ## Enable the Temporary Access Pass policy

2626

27 −A TAP policy defines settings, such as the lifetime of passes created in the tenant, or the users and groups who can use a TAP to sign-in.

27 +A TAP policy defines settings, such as the lifetime of passes created in the tenant, or the users and groups who can use a TAP to sign in.

2828

29 −Before users can sign-in with a TAP, you need to enable this method in the Authentication methods policy and choose which users and groups can sign in by using a TAP.

29 +Before users can sign in with a TAP, you need to enable this method in the Authentication methods policy and choose which users and groups can sign in by using a TAP.

3030

31 −Although you can create a TAP for any user, only users included in the policy can sign-in with it. You need the [Authentication Policy Administrator](../role-based-access-control/permissions-reference.md#authentication-policy-administrator) role to update the TAP Authentication methods policy.

31 +Although you can create a TAP for any user, only users included in the policy can sign in with it. You need the [Authentication Policy Administrator](../role-based-access-control/permissions-reference.md#authentication-policy-administrator) role to update the TAP Authentication methods policy.

3232

3333 To configure TAP in the Authentication methods policy:

3434

⋯ 95 unchanged lines

130130

131131 The user is now signed in and can update or register a method such as FIDO2 security key.

132132 Users who update their authentication methods due to losing their credentials or device should make sure they remove the old authentication methods.

133 −Users can also continue to sign-in by using their password; a TAP doesn’t replace a user’s password.

133 +Users can also continue to sign in by using their password; a TAP doesn't replace a user's password.

134134

135135 ### User management of Temporary Access Pass

136136

137137 Users managing their [Security info](https://mysignins.microsoft.com/security-info) see an entry for the Temporary Access Pass. If a user doesn't have any other registered methods, they get a banner at the top of the screen that says to add a new sign-in method. Users can also see the TAP expiration time, and delete the TAP if it's no longer needed.

138138

139 −:::image type="content" border="true" source="./media/how-to-authentication-temporary-access-pass/tap-my-security-info.png" alt-text="Screenshot of how users can manage a Temporary Access Pass in My Security Info..":::

139 +:::image type="content" border="true" source="./media/how-to-authentication-temporary-access-pass/tap-my-security-info.png" alt-text="Screenshot of how users can manage a Temporary Access Pass in My Security Info.":::

140140

141141 ### Device enrollment and passwordless registration

142142

⋯ 6 unchanged lines

149149 - If the device enrollment process reaches the Windows Hello for Business registration step after more than 10 minutes, a second single-use TAP must be provided to complete the credential enrollment. |

150150 |One multiuse TAP | If your organization enables multiuse TAPs, a user can sign in with a single TAP multiple times during its validity period. For example, a user can sign in with a single TAP multiple times for one hour.| In this case:<br>

151151 - A user can enter the same TAP once to enroll their device, and again to register Windows Hello for Business.

152 −- The 10-minute MFA requirement effectively restarts when the user begins to register the new authentication method. The timer restart protects the device enrollemnt and authentication registration process from interruption.<br>A multiuse TAP can simplify the end-user experience by reducing the need to distribute multiple passcodes. If you choose to enable multiuse TAPs, consider monitoring TAP usage to ensure it is not used more times than expected during its validity period. |

152 +- The 10-minute MFA requirement effectively restarts when the user begins to register the new authentication method. The timer restart protects the device enrollment and authentication registration process from interruption.<br>A multiuse TAP can simplify the end-user experience by reducing the need to distribute multiple passcodes. If you choose to enable multiuse TAPs, consider monitoring TAP usage to ensure it is not used more times than expected during its validity period. |

153153

154154 ### Windows device setup

155155

⋯ 28 unchanged lines

184184

185185 If you try to add a TAP to an external guest account in the Microsoft Entra admin center or in Microsoft Graph, you'll receive an error stating **Temporary Access Pass cannot be added to an external guest user.**

186186

187 −External guest users can sign-in to a resource tenant with a TAP issued by their home tenant if the TAP meets the home tenant authentication requirements and Cross Tenant Access policies have been configured to trust MFA from the users home tenant, see [Manage cross-tenant access settings for B2B collaboration](/entra/external-id/cross-tenant-access-settings-b2b-collaboration).

187 +External guest users can sign in to a resource tenant with a TAP issued by their home tenant if the TAP meets the home tenant authentication requirements and Cross Tenant Access policies have been configured to trust MFA from the users home tenant, see [Manage cross-tenant access settings for B2B collaboration](/entra/external-id/cross-tenant-access-settings-b2b-collaboration).

188188

189189 ### Expiration

190190

⋯ 56 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:02 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.