Authentication Method Policy - Temporary Access Pass

Temporary Access Pass (TAP) provides time-limited passcodes that can be used for authentication and onboarding scenarios. Administrators can configure the lifetime, length, and whether the pass is single-use or multi-use. TAP is useful for passwordless onboarding, account recovery, and temporary access scenarios.

Settings this baseline controls

Setting	What it does
Method enabled	Specifies whether Temporary Access Pass authentication method is enabled or disabled for the tenant. Learn more
Included users	Groups and users explicitly included to use Temporary Access Pass authentication method. Learn more
Excluded users	Groups and users explicitly excluded from using Temporary Access Pass authentication method. Learn more
Minimum lifetime minutes	Minimum lifetime in minutes for a Temporary Access Pass. Minimum value is 10 minutes, maximum is 43200 (30 days). Learn more
Maximum lifetime minutes	Maximum lifetime in minutes for a Temporary Access Pass. Minimum value is 10 minutes, maximum is 43200 (30 days). Learn more
Default lifetime minutes	Default lifetime in minutes for a Temporary Access Pass when created. Must be between minimum and maximum lifetime. Learn more
Default pass length	Default length (number of characters) for a Temporary Access Pass. Must be between 8 and 48 characters. Learn more
One-time use enforced	Determines whether the Temporary Access Pass is single-use (true) or multi-use (false). Learn more

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.→

Configure it

Add this to the tenant, or through a scheme, so your helpdesk can give a new starter (or anyone who’s lost every registered method) a short-lived passcode to sign in and register properly, instead of resetting a password over the phone.

1. Add the baseline to the tenant directly (Adding a baseline) or through a scheme (Deploying a scheme).

2. Turn on Method enabled, targeting all users under Included users so any account can be issued a pass when needed.

3. Set Minimum lifetime minutes, Maximum lifetime minutes and Default lifetime minutes all to 10, and Default pass length to 8 characters. The baseline keeps passes short-lived because a Temporary Access Pass can bypass a user’s other registered methods.

4. Set One-time use enforced to suit how your helpdesk works: on if a pass should be spent the moment it’s used, off if the same pass needs to keep working for a short window while someone finishes onboarding.

5. Save. Auto-remediation is safe here: it keeps the policy’s lifetime and length limits in place and doesn’t affect any pass already issued.

Caution

A Temporary Access Pass lets someone sign in and register new methods without their usual password or MFA. Before issuing one, verify the person’s identity another way, such as a callback to a known number or confirmation from their manager; a request over chat or email alone isn’t enough.

Check it worked

Passing means Entra ID → Authentication methods → Policies → Temporary Access Pass shows the method enabled with a 10-minute lifetime and 8-character length. A helpdesk operator can now issue a pass from a user’s authentication methods page; the user types it in place of a password and is immediately asked to register a real method.

Standards this addresses

CISM365 5.2.3.xv8 6.3

NISTPR.AC-7IA-5

ISO 27001A.8.3.3

GDPRArticle 32

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme→