Temporary Access Pass
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit c373a3d · +2 −2 lines · also on GitHub
⋯ 142 unchanged lines
143143
When using a Temporary Access Pass (TAP) to support device enrollment and passwordless credential registration (for example, Windows Hello for Business), there are two supported approaches to ensure a smooth end-user experience.
144144
145145
146
−| Option | Process | Steps |
147
−|--------|---------|-------|
146
+| Option | Process description | Steps |
147
+|:--------:|:-------------------:|:-------:|
148148
| Two single-use TAPs | If your organization enforces single-use TAPs, and the overall device enrollment process takes longer than 10 minutes, users need to enter another TAP for passwordless credential registration. When users enter a single-use TAP to register a passwordless authentication method, the registration must be completed within 10 minutes of sign-in. This behavior is consistent across all new authentication method registrations that require multifactor authentication (MFA), including registrations initiated through [Security info](https://mysignins.microsoft.com/security-info). The 10-minute requirement relates to MFA enforcement during credential registration, but not TAP specifically. | The first single-use TAP is used to complete device enrollment. If the device enrollment process reaches the Windows Hello for Business registration step after more than 10 minutes, a second single-use TAP must be provided to register the credential.|
149149
| One multiuse TAP | If your organization enables multiuse TAPs, a user can sign in with a single TAP multiple times during its validity period. For example, a user can sign in with a single TAP multiple times for one hour. A multiuse TAP can simplify the end-user experience by reducing the need to distribute multiple passcodes. Monitor TAP usage to ensure it's not used more times than expected during its validity period. | A user can enter the same TAP once to enroll their device, and again to register Windows Hello for Business. The 10-minute MFA requirement effectively restarts when the user begins to register the new authentication method. The timer restart prevents interruption. |
150150
⋯ 93 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:02 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.