Temporary Access Pass is now in public preview

[Alex Simons (AZURE)]

Today we announced the general availability of our passwordless solution and the public preview of Temporary Access Pass in Azure Active Directory. Temporary Access Pass is a game-changer that completes the end-to-end passwordless onboarding experience for your users. It is a time-limited passcode they can use to set up security keys and the Microsoft Authenticator without ever needing to use, much less know, a password!

I’ve invited Inbar Cizer Kobrinsky, a senior program manager on the Identity Security team, to share more details about Temporary Access Pass.

Best Regards,

Alex Simons (Twitter: @alex_a_simons)

Corporate Vice President Program Management

Microsoft Identity Division

------------------------------------------------------------

Hi everyone!

We created Temporary Access Pass to address many of your passwordless account onboarding and recovery scenarios. In this post, I’ll introduce you to its capabilities and share why you should try it for yourself.

What is Temporary Access Pass?

For a user to truly be passwordless, they shouldn’t know or use their password, and instead use passwordless authentication methods and recovery if they lose their authentication devices.

Temporary Access Pass is a time-limited passcode that allows users to register passwordless methods authentication and recover access to their account without a password.

Admin experience

The authentication methods policy helps to harden the security around Temporary Access Pass issuance based on your needs. For example, you can limit it to specific users and groups, limit the use for a short period, or set it for one-time use. After enabling the Temporary Access Pass policy, you can then create a Temporary Access Pass for your users.

Temporary Access Pass authentication method policy

The updated user authentication method page allows a privileged authentication administrator and an authentication administrator to create a Temporary Access Pass for a user, within the allowed limits of the Temporary Access Pass authentication methods policy.

Creating a new Temporary Access Pass on a user from the Azure AD portal

End user experience

Once a user has a valid Temporary Access Pass, they can use it to sign in and register a FIDO2 key from the My Security Info page or register for passwordless phone sign-in directly from the Authenticator app.

Sign in to Azure AD with Temporary Access Pass

Learn more

You can learn more about how to configure Temporary Access Pass in documentation.

Some of you may have existing applications for new employee onboarding experiences. Temporary Access Pass is available through the Microsoft Graph APIs, so you can incorporate it into your existing applications. Get details on TAP authentication method APIs and on how to use the policy APIs.

Tell us what you think

Give it a try and let us know if you have questions or feedback. I hope you will love it as much as we do!

Inbar Cizer Kobrinsky (@inbarck),

Senior Program Manager,

Microsoft Identity Division

Learn more about Microsoft identity:

• Return to the Azure Active Directory Identity blog home
• Join the conversation on Twitter and LinkedIn
• Share product suggestions on the Azure Feedback Forum

[Chris_Clark_Netrix]

Will this only work for Azure AD Cloud groups vs AD synced groups?

[Inbar Cizer Kobrinsky]

Hi @Chris_Clark_Netrix - If I understand correctly you are asking about scoping to users and groups - the answer is that you can scope the policy to any group. 

[Chris_Clark_Netrix]

Sorry, I phrased that wrong.  @Inbar Cizer Kobrinsky Does this only work for Azure AD cloud only accounts or can it work with AD Synced accounts as well?

[Inbar Cizer Kobrinsky]

@Chris_Clark_Netrix  - you can issue Temporary Access Pass for cloud and federated accounts. If a federated user has a valid pass, they will be able to use it for cloud authentication and register a passwordless method. From that point on, the user can be federated but if using passwordless method - they will be able to do cloud authentication. 

[Unearth]

I understand this is primarily designed to help users get registered for passwordless - but for customers who are still using passwords/MFA, can it be used by IT to provide temporary access to a user's account (say, to log into their AzureAD joined workstation) without having to reset their password? Or for say the ability to start the autopilot process on their laptop for them? If so, i assume the login will still be subject to MFA challenge, or does TAP bypass that? Thanks!

[Kevin Kuphal]

@Unearth I saw this when reading about the pass. 

https://www.inthecloud247.com/my-first-experience-with-temporary-access-pass-during-windows-autopilo...

It definitely appears to work with Autopilot but it does appear to have limitations for Hybrid AD joined computers.

[ramagates]

@Inbar Cizer Kobrinsky any dates to enable back the TAP for autopilot. It has been disabled last week

[Jonas Back]

@Inbar Cizer Kobrinsky we're doing a pilot this week with 100 users using this. One question, we're creating new Azure AD (Cloud Only) users for this. By default when you create these you have to create an initial password (or let Azure AD autogenerate one for you). This means the users will actually have a password under the hood (even though never used).

Comments? Any plans to make it possible to create users that truly don't have a password or am I missing something?

[Reza_Ameri]

This is great feature but we are observing new risk and it is hackers are moving toward hacking mobile devices and in this case, they would have access to Authenticator apps and credentials. 

In addition, hacking phone are much easier than Windows, so this is a new concern.

But options like Windows Hello are great passwordless methods.

[Andreas_Rinner]

@Jonas Back Regarding your last question. It is still an ongoing task to become really passwordless as stated in the following Microsoft Mechanics video: https://youtu.be/GfKeiKA8aEo?t=63

Currently it is just use the passsword less :D

I guess that as long as Microsoft 365 Roadmap | Microsoft 365 has the task to deploy TAP still listed as "Rolling out" new way to remove need for user passwords can't be enabled. 

[Jonas Back]

@Andreas_Rinner that is correct! I actually reached out to a program manager at Microsoft and he confirmed that it's still required to set an initial password but they will solve it in the future.

[msconfig87]

do you know what the correct saml2.0 claim is called for this? something with urn:oasis:names.....   ?

[Mark Gonzalez]

@Inbar Cizer Kobrinsky any plans/roadmap items for making this available in GCC/GCCH?

[Sander de Wit]

Any update on using TAP (temporary access pass) to set-up a device after AutoPilot predeployment and also to enroll Windows Hello for Business?
Otherwise it kinda defeats the purpose of having TAP...

[Libby Brown]

@Mark Gonzalez, @Sander de Wit - both your requests are in the works as part of bringing TAP to general availability. 

[Mark Gonzalez]

@Libby Brown Thanks!  Any thoughts when it might be updated/added to the roadmap site? 

https://www.microsoft.com/en-us/microsoft-365/roadmap?filters=&searchterms=Temporary%2CAccess%2CPass

Thanks again Libby!

Mark 

[wilhil]

Is there a reason this doesn't work on OOBE?

It's the most common requirement we have at clients to stop sharing passwords for provisioning legacy complex apps that can't be deployed via MDM.

[BrandonDBC]

UPDATE!!!
After allowing enough time for Azure sync to complete, user can now use TAP successfully. One thing have to remember, that any changes in cloud can take time to replicate before changes are applied. 

I configured our tenant per the documentation, but so far my test account that I am using continues to receive error: Temporary Access Pass sign-in was blocked due to User Credential Policy. I have all users assigned to combined security registration feature that forces them to use single registration portal. Any insight as to what may be cause for not allowing access after TAP accepts the assigned temp password. 

[Tim Larson]

@wilhil We hear you and are working on adding TAP support for OOBE experiences. 

[Hemanthreddy247]

After if we enable the temporary pass from Azure AD - Security - Authentication methods. I understood that we need to enable the authentication methods explicitly for each user to use Temporary Access. Is there a way to validate or identify for how many users the temporary access is enabled?

Appreciate your response.

Regards,

Hemanth