Issue Microsoft Entra Temporary Access Passes as controlled bootstrap credentials

Bottom line: Microsoft Entra Temporary Access Pass (TAP) is a time-limited passcode for bootstrapping passwordless authentication or helping a user recover when a strong method is unavailable. It is still a usable sign-in credential. Treat its creation, delivery, use, and removal as a controlled identity operation rather than a convenience code sent through an unverified support channel.

Source fact: what Microsoft documents

Microsoft’s Temporary Access Pass guidance says a TAP can be configured for one use or multiple sign-ins. A user can use it to register methods such as a passkey, FIDO2 security key, Windows Hello for Business, or Microsoft Authenticator. In a federated domain, TAP authentication is completed by Microsoft Entra instead of redirecting the user to the federated identity provider.

The authentication methods policy controls which users may sign in with TAP and sets parameters such as minimum, maximum, and default lifetime, one-time-use behavior, and passcode length. Microsoft distinguishes the role used to manage the tenant policy from roles that can create, view, or delete a user’s TAP. The actual passcode is displayed when it is created and cannot be viewed again after the administrator closes that display.

Microsoft also documents important boundaries. A user can have only one TAP at a time. A TAP issued to an external guest is not supported, although an external guest may use a TAP issued by the home tenant when cross-tenant requirements are satisfied. An expired or deleted TAP cannot be used for new authentication, but expiration does not retroactively terminate every already-established session. Conditional Access session controls can therefore affect how long access obtained through the sign-in continues.

What the source does not establish

The Microsoft page does not verify the requester’s identity, authorize a help-desk action, select a safe delivery channel, or prove that the intended user received the code. It does not make TAP an appropriate response to every lost-device, new-hire, or recovery scenario. A short lifetime does not compensate for weak requester verification, excessive administrator access, or an unmonitored handoff.

Applicability questions

• Which onboarding and recovery cases are approved to use TAP, and which require escalation?
• How will the operator verify the person and the authorized request without relying on a compromised method?
• Will one-time use work for the enrollment path, including device setup and passwordless registration timing?
• Which administrators can manage the policy or issue passes, and how are their actions reviewed?
• Does Conditional Access limit session duration appropriately after TAP authentication?

DSE recommendation: controlled next steps

The following steps are DSE recommendations based on the cited source.

1. Define approved TAP scenarios, identity-proofing steps, authorizers, administrator roles, delivery channels, maximum lifetimes, and escalation triggers.
2. Pilot the complete enrollment and recovery journey with test identities. Include federated users, managed-device enrollment, delayed registration, and a failed or expired pass.
3. Verify the requester through an approved independent process before creation. Record the request, purpose, operator, start time, duration, and whether the pass is single-use.
4. Deliver the pass through a channel selected for the assessed risk. Avoid placing the TAP beside enough account context for an unintended recipient to use it.
5. Require the user to register the intended strong method, remove obsolete methods when authorized, and report completion through the support workflow.
6. Delete an unused or no-longer-needed TAP and investigate unexplained issuance, repeated failures, or registration outside the approved window.

Verification and evidence

• Preserve the approved request and administrator audit event without recording the TAP value.
• Confirm the intended authentication method is registered and usable.
• Confirm the TAP is expired, consumed, replaced, or deleted as designed.
• Review sign-in evidence for unexpected resources, locations, devices, or continued sessions.
• Record exceptions and the person who accepted any remaining exposure.

Official references

• Configure Temporary Access Pass to register passwordless authentication methods — Microsoft