Temporary Access Pass (TAP)

A Temporary Access Pass (TAP) is a time-limited passcode in Microsoft Entra ID, issued by an administrator, that a user signs in with to register a passwordless method such as a passkey or Windows Hello for Business, or to recover after losing their usual method. Microsoft Learn defines it as "a time-limited passcode that can be configured for single use or multiple sign-ins."

The documented settings (checked 2026-11-05):

Authentication Administrators can issue a TAP for members and Privileged Authentication Administrators for admins, never for themselves, and each user can hold only one. Only users in scope of the TAP authentication methods policy can sign in with one. A one-time TAP must be used to finish registering a passwordless method within 10 minutes of sign-in. A TAP cannot be used with the NPS extension or the AD FS adapter, and for federated domains Entra handles the TAP sign-in itself rather than redirecting to the federated IdP.

It matters because onboarding and recovery are where phishing-resistant programs leak: if a new hire bootstraps a passkey with an SMS code, the passkey is only as strong as that code. A TAP handed over after an identity proofing check closes that gap. Two cautions. Tokens issued during a TAP sign-in can outlive the TAP, so set a sign-in frequency policy; and a TAP issued over the phone is exactly what help desk social engineering is after, so verify the caller before issuing one.

See also: account recovery, passwordless, phishing-resistant MFA, implementing passkeys in the enterprise, Microsoft Entra