# Authentication Method Policy - Temporary Access Pass

> Temporary Access Pass (TAP) provides time-limited passcodes that can be used for authentication and onboarding scenarios.

Temporary Access Pass (TAP) provides time-limited passcodes that can be used for authentication and onboarding scenarios. Administrators can configure the lifetime, length, and whether the pass is single-use or multi-use. TAP is useful for passwordless onboarding, account recovery, and temporary access scenarios.

## Settings this baseline controls

| Setting                  | What it does                                                                                                                                                                                                                                 |
| ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Method enabled           | Specifies whether Temporary Access Pass authentication method is enabled or disabled for the tenant. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/temporaryaccesspassauthenticationmethodconfiguration)                |
| Included users           | Groups and users explicitly included to use Temporary Access Pass authentication method. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/temporaryaccesspassauthenticationmethodconfiguration)                            |
| Excluded users           | Groups and users explicitly excluded from using Temporary Access Pass authentication method. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/temporaryaccesspassauthenticationmethodconfiguration)                        |
| Minimum lifetime minutes | Minimum lifetime in minutes for a Temporary Access Pass. Minimum value is 10 minutes, maximum is 43200 (30 days). [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/temporaryaccesspassauthenticationmethodconfiguration)   |
| Maximum lifetime minutes | Maximum lifetime in minutes for a Temporary Access Pass. Minimum value is 10 minutes, maximum is 43200 (30 days). [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/temporaryaccesspassauthenticationmethodconfiguration)   |
| Default lifetime minutes | Default lifetime in minutes for a Temporary Access Pass when created. Must be between minimum and maximum lifetime. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/temporaryaccesspassauthenticationmethodconfiguration) |
| Default pass length      | Default length (number of characters) for a Temporary Access Pass. Must be between 8 and 48 characters. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/temporaryaccesspassauthenticationmethodconfiguration)             |
| One-time use enforced    | Determines whether the Temporary Access Pass is single-use (true) or multi-use (false). [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/temporaryaccesspassauthenticationmethodconfiguration)                             |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

Add this to the tenant, or through a scheme, so your helpdesk can give a new starter (or anyone who's lost every registered method) a short-lived passcode to sign in and register properly, instead of resetting a password over the phone.

1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)) or through a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Turn on **Method enabled**, targeting all users under **Included users** so any account can be issued a pass when needed.
3. Set **Minimum lifetime minutes**, **Maximum lifetime minutes** and **Default lifetime minutes** all to 10, and **Default pass length** to 8 characters. The baseline keeps passes short-lived because a Temporary Access Pass can bypass a user's other registered methods.
4. Set **One-time use enforced** to suit how your helpdesk works: on if a pass should be spent the moment it's used, off if the same pass needs to keep working for a short window while someone finishes onboarding.
5. Save. **Auto-remediation** is safe here: it keeps the policy's lifetime and length limits in place and doesn't affect any pass already issued.

> **Caution:** A Temporary Access Pass lets someone sign in and register new methods without their usual password or MFA. Before issuing one, verify the person's identity another way, such as a callback to a known number or confirmation from their manager; a request over chat or email alone isn't enough.

## Check it worked

Passing means **Entra ID → Authentication methods → Policies → Temporary Access Pass** shows the method enabled with a 10-minute lifetime and 8-character length. A helpdesk operator can now issue a pass from a user's authentication methods page; the user types it in place of a password and is immediately asked to register a real method.

## Standards this addresses

### CIS

- **M365 5.2.3.x** — CIS M365 Foundations Benchmark 5.2.3.x
- **v8 6.3** — CIS Controls v8 Safeguard 6.3

### NIST

- **PR.AC-7** — NIST CSF 2.0 PR.AC-7
- **IA-5** — NIST SP 800-53 IA-5

### ISO 27001

- **A.8.3.3** — ISO/IEC 27001:2022 Annex A.8.3.3

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)