Temporary Access Pass
A Temporary Access Pass is a time-limited Microsoft Entra ID passcode that can support sign-in and registration of authentication methods during onboarding or recovery.
A short-lived way to register a lasting method
A TAP is a Microsoft Entra feature used during onboarding or recovery. An administrator can configure it for one use or multiple sign-ins, and the tenant’s authentication-method policy determines which users can use it.
It can let a user register a replacement authenticator. That makes issuance an access decision: verify the recipient through the approved recovery process before delivering the pass. Keep the passcode out of support notes.
Expiration does not undo everything done with the pass
A TAP does not replace the account’s password. Its expiration also does not remove an authenticator registered while it was usable.
Microsoft documents that TAP expiration does not retroactively invalidate established sessions; Conditional Access session controls affect how long access can persist. During an investigation, separate the pass being issued, the pass being used, and the method being registered. An issuance record establishes only the first of those.
Administrators cannot issue a TAP to an external guest object in the resource tenant. Use of a home-tenant TAP is a separate cross-tenant case with its own requirements.