Temporary Access Pass

This page's changes and edits · All guidance changes

Microsoft's edit · 10 Feb 19:30 UTC

Update howto-authentication-temporary-access-pass.md

Microsoft's commit message in MicrosoftDocs/entra-docs · commit bb244be · +8 −3 lines · also on GitHub

⋯ 143 unchanged lines

144144

145145

146146 | Option | Process description | Steps |

147 −|:--------:|:-------------------:|:-------:|

148 −| Two single-use TAPs | If your organization enforces single-use TAPs, and the overall device enrollment process takes longer than 10 minutes, users need to enter another TAP for passwordless credential registration. When users enter a single-use TAP to register a passwordless authentication method, the registration must be completed within 10 minutes of sign-in. This behavior is consistent across all new authentication method registrations that require multifactor authentication (MFA), including registrations initiated through [Security info](https://mysignins.microsoft.com/security-info). The 10-minute requirement relates to MFA enforcement during credential registration, but not TAP specifically. | The first single-use TAP is used to complete device enrollment. If the device enrollment process reaches the Windows Hello for Business registration step after more than 10 minutes, a second single-use TAP must be provided to register the credential.|

149 −| One multiuse TAP | If your organization enables multiuse TAPs, a user can sign in with a single TAP multiple times during its validity period. For example, a user can sign in with a single TAP multiple times for one hour. A multiuse TAP can simplify the end-user experience by reducing the need to distribute multiple passcodes. Monitor TAP usage to ensure it's not used more times than expected during its validity period. | A user can enter the same TAP once to enroll their device, and again to register Windows Hello for Business. The 10-minute MFA requirement effectively restarts when the user begins to register the new authentication method. The timer restart prevents interruption. |

147 +|:--------:|:--------------------|:--------|

148 +| Two single-use TAPs | If your organization enforces single-use TAPs, and the overall device enrollment process takes longer than 10 minutes, users need to enter another TAP for passwordless credential registration. When users enter a single-use TAP to register a passwordless authentication method, the registration must be completed within 10 minutes of sign-in.

149 + This behavior is consistent across all new authentication method registrations that require multifactor authentication (MFA), including registrations initiated through [Security info](https://mysignins.microsoft.com/security-info).

150 + The 10-minute requirement relates to MFA enforcement during credential registration, but not TAP specifically. | - The first single-use TAP is used to complete device enrollment.

151 + - If the device enrollment process reaches the Windows Hello for Business registration step after more than 10 minutes, a second single-use TAP must be provided to register the credential.|

152 +| One multiuse TAP | If your organization enables multiuse TAPs, a user can sign in with a single TAP multiple times during its validity period. For example, a user can sign in with a single TAP multiple times for one hour.

153 + A multiuse TAP can simplify the end-user experience by reducing the need to distribute multiple passcodes. Monitor TAP usage to ensure it's not used more times than expected during its validity period. | - A user can enter the same TAP once to enroll their device, and again to register Windows Hello for Business.

154 + - The 10-minute MFA requirement effectively restarts when the user begins to register the new authentication method. The timer restart prevents interruption for device setup. |

150155

151156 ### Windows device setup

152157

⋯ 91 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:02 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.