Temporary Access Pass: a valuable tool that needs strict controls
How does a new employee register their first passkey when they have no strong method yet? How does a user who has lost their phone get back into their account? The Temporary Access Pass answers both questions. But a code that satisfies MFA and that an administrator can create for anyone deserves particular care.
What the Temporary Access Pass is for
The Temporary Access Pass (TAP) is a time-limited code created by an administrator for a specific user. Entra ID treats it as strong authentication: a user who enters it satisfies the MFA requirement and can register other methods, especially passwordless ones such as passkeys or Windows Hello for Business.
It has two main uses:
- Onboarding: a new starter receives a pass, signs in and immediately registers a phishing-resistant method, without ever using a password;
- Recovery: a user who has lost all their methods regains access long enough to register new ones.
Policy settings
The Temporary Access Pass is configured in the authentication methods policy. The main settings are:
| Setting | Purpose | Recommendation |
|---|---|---|
| Target users | Who can receive a pass | Everyone, or groups defined by use case |
| Minimum and maximum lifetime | Validity bounds for a pass | A short maximum, in the order of a few hours for recovery |
| Default lifetime | Value offered at issuance | As short as possible |
| One-time use | The pass works for a single sign-in only | Require it by default |
| Length | Number of characters in the code | Keep a sufficient length |
The exact bounds allowed by Entra ID may change; check them in the current Microsoft documentation. Some scenarios, such as setting up a Windows device, may require a multi-use pass: keep it for those cases and limit its lifetime.
Who can issue it
Creating a pass is restricted to certain roles: Authentication Administrator for non-privileged users, Privileged Authentication Administrator and Global Administrator for all users. This means a helpdesk account holding the Authentication Administrator role can, in a few clicks, gain full access to an ordinary user's account, MFA included. Several levers limit that power:
- assign these roles through PIM, as eligible, rather than permanently;
- narrow their scope with administrative units where the organisation allows it;
- protect sensitive accounts, such as executives, with restricted management administrative units.
The main risk: social engineering
The Temporary Access Pass is technically sound. Its weakness is human: an attacker posing as an employee who has lost their phone can talk the helpdesk into issuing one. Several threat groups have made this technique their speciality. The identity verification procedure before issuance is therefore as important as the configuration itself: call-back to a known number, approval by the line manager, in-person identity check or a verification service.
Monitor every issuance. Pass creation is recorded in the Entra ID audit logs. A pass issued for a privileged account, outside business hours or followed by the registration of an unfamiliar new method should trigger an immediate check.
What an audit checks
- Whether the Temporary Access Pass is enabled and which groups are targeted.
- The maximum lifetime, the default lifetime and the one-time use requirement.
- The accounts allowed to issue passes and how their roles are assigned.
- The identity verification procedure followed by the helpdesk.
- Monitoring of issuances and of methods registered afterwards.