Temporary Access Pass: a safe start for new employees without a password on a sticky note

You want this method to be available to new employees, but with clear limits.

You can create a TAP for anyone, but only users who are in the policy can actually sign in with it. So enable the policy first.

1. 1Sign in to the Microsoft Entra admin center as at least Authentication Policy Administrator.
2. 2Go to Entra ID, Authentication methods, Policies and choose Temporary Access Pass.
3. 3Switch on Enable and choose which users or groups are included. Start with a group for new employees and one for IT, and widen it once it works.
4. 4Choose Configure to set the lifetime, the length and one-time use (see below), and click Update.
5. 5Click Save.

Once the policy is set correctly, an administrator can issue a TAP for an employee.

An Authentication Administrator can create a TAP for ordinary users, a Privileged Authentication Administrator for administrators too. Neither can do it for themselves. A Global Reader can see that a TAP exists, but not the code.

1. 1Go to Entra ID, Users and choose the user.
2. 2Choose Authentication methods, Add authentication method and then Temporary Access Pass.
3. 3Set a start time or a duration and click Add.
4. 4Write down the code. After OK you will not see it again.

Connect-MgGraph -Scopes "UserAuthenticationMethod.ReadWrite.All"

$tap = @{
  startDateTime     = "2026-12-01T08:00:00+01:00"
  lifetimeInMinutes = 600
  isUsableOnce      = $true
}
$resultaat = New-MgUserAuthenticationTemporaryAccessPassMethod -UserId "sanne.bakker@bedrijf.nl" -BodyParameter $tap
$resultaat.TemporaryAccessPass

# Check that it is there (you no longer see the code itself here)
Get-MgUserAuthenticationTemporaryAccessPassMethod -UserId "sanne.bakker@bedrijf.nl" |
  Select-Object StartDateTime, LifetimeInMinutes, IsUsableOnce, IsUsable, MethodUsabilityReason

POST https://graph.microsoft.com/v1.0/users/sanne.bakker@bedrijf.nl/authentication/temporaryAccessPassMethods
Content-Type: application/json

{
  "startDateTime": "2026-12-01T08:00:00+01:00",
  "lifetimeInMinutes": 600,
  "isUsableOnce": true
}

The lifetime must fall within the policy's minimum and maximum, otherwise Entra ID rejects the TAP. A user can only have one at a time: if you create a new one, it replaces the old one. You remove an expired TAP with Remove-MgUserAuthenticationTemporaryAccessPassMethod.

The aim is for someone to set up their own secure sign-in method straight away. After that the temporary code is no longer needed.

The employee goes to mysignins.microsoft.com/security-info, enters their username and, if they are in the policy, gets a field for the TAP. They then register their methods. There are three common routes:

• Microsoft Authenticator. Add a work or school account in the app and sign in with the TAP. From the app they register a passkey and phone sign-in.
• A new Windows laptop. While joining it to Entra ID (Entra join) they sign in with the TAP, without a password, and set up Windows Hello for Business. On a laptop that is already joined, or hybrid joined, they first have to sign in with another method, such as a password.
• A security key (FIDO2). Sign in to Security info with the TAP and add the key.

If the user also falls under the self-service password reset registration policy or the Entra ID Protection MFA registration policy, Entra ID sends them to the mandatory registration screen after signing in with the TAP. According to Microsoft, they cannot register a FIDO2 key or phone sign-in there. If you want to start passwordless, take new employees out of those policies or have them register through the Authenticator app.

Tokens from a sign-in with the TAP are valid at most until the TAP expires. A session that is already running does not stop when the TAP expires; how long it lasts is decided by your Conditional Access settings. If you want someone to sign in again soon after the TAP with their own method, set a sign-in frequency.

A secure code does little good if you send it through an insecure or wrong channel.

A TAP is a strong sign-in: whoever has the code can take over the account until it expires. So treat it as you would a password, or more strictly. The obvious route does not work: a new employee cannot open their work mailbox yet, because that is exactly what they need the TAP for.

If someone loses their phone, they can no longer complete MFA and so cannot register a new phone themselves either. A TAP solves that without switching MFA off:

1. 1Check who is calling. Issuing a TAP to the wrong person is exactly the attack you want to prevent. Have the manager confirm, for example.
2. 2Remove the old Authenticator registration, so the lost phone can no longer give approvals: Remove-MgUserAuthenticationMicrosoftAuthenticatorMethod.
3. 3Create a single-use TAP with a short validity and pass it on through a route that does not go through that phone.
4. 4The employee signs in with the TAP and registers their new phone or passkey. Then check that no old methods have been left behind.

A TAP does not work with the NPS extension or the AD FS adapter. If you use those for VPN or older applications, a TAP will not help there.