A practical implementation guide for automating Microsoft Temporary Access Pass generation using SailPoint ISC Workflows and Microsoft Graph APIs.
Overview
First-day access remains a challenge for many organizations. New hires often depend on temporary passwords, manual coordination, and service desk assistance before they can access company resources.
Microsoft Temporary Access Pass (TAP) provides a secure, short-lived credential that can be used for first-time sign-in and registration of password-less authentication methods such as Microsoft Authenticator, FIDO2 Security Keys, Windows Hello for Business, or Passkeys. When combined with SailPoint ISC Workflows, TAP generation can be automated as part of the joiner process.
In this implementation, SailPoint automatically generates a TAP when a new Microsoft Entra ID account is provisioned and sends the TAP details and onboarding instructions to the employee’s manager for secure distribution to the new hire.
For organizations operating primarily in Microsoft Entra ID, this approach can help accelerate password-less adoption because users register their authentication methods as part of onboarding. For enterprises that still rely on on-premises Active Directory, it can serve as a practical first step toward a password-less journey while continuing to support existing hybrid identity requirements.
This article demonstrates how to use SailPoint ISC Workflows and Microsoft Graph APIs to automate TAP generation and streamline the onboarding experience.
What is Microsoft Temporary Access Pass (TAP)?
Temporary Access Pass (TAP) is a time-bound passcode in Microsoft Entra ID that allows users to sign in for the first time without requiring a traditional password reset process.
TAP is commonly used during onboarding to help users register approved password-less authentication methods such as:
- Microsoft Authenticator
- FIDO2 Security Keys
- Windows Hello for Business
- Passkeys
Users can also use TAP to establish their first password if required. In hybrid environments, that password can synchronize or write back to on-premises Active Directory when Password Writeback is enabled.
Because TAP is intended for temporary access scenarios, it should be configured with a limited lifetime and one-time use whenever possible.
Prerequisites
Before implementing this solution, ensure the following prerequisites are in place:
- Microsoft Entra tenant with Temporary Access Pass enabled in the Authentication Methods policy.
- TAP policy configured for complexity requirements, expiration, and usage settings.
- Microsoft Entra application registration for Microsoft Graph access.
- Microsoft Graph application permission:
UserAuthenticationMethod.ReadWrite.All
- Administrative consent granted.
- SailPoint Identity Security Cloud Workflows enabled.
- Delinea Secret Server (cloud or on-premises) with REST API access.
- A dedicated onboarding folder in Secret Server where the relevant managers, or a managers group, have View and Retrieve permissions.
- A Secret Server service account the workflow uses to authenticate and create secrets, with permission to add secrets to that folder.
Options to Share the TAP
This guide stores the TAP in Delinea Secret Server and emails the manager a retrieval link, but the same TAP can be delivered in other ways depending on where your provisioning logic lives and what tooling you already run. Common options include:
- SailPoint Workflow with a secure vault or secret service (used in this guide). The workflow generates the TAP and stores it in an enterprise vault such as Delinea Secret Server, CyberArk, or an equivalent, then sends the manager a one-time link. Delivery and audit stay inside your IGA and PAM tooling.
- After Create connector rule with PowerShell (IQService). For organizations provisioning to on-premises Active Directory through SailPoint’s IQService, an After Create connector rule can run PowerShell on the IQService host right after the account is created. The rule generates or retrieves the TAP, for example by calling Microsoft Graph, and routes it to your secure channel. Keep the rule itself minimal and place the real logic in a PowerShell script on your own server. This is SailPoint’s recommended pattern and lets you maintain the script without platform code review. This option suits hybrid and AD-first environments where the work belongs at the provisioning layer rather than in a cloud workflow.
Solution Overview
At a high level, the solution works as follows:
- A new user account is provisioned in Microsoft Entra ID.
- SailPoint ISC Workflow is triggered.
- Microsoft Graph generates a Temporary Access Pass.
- User and manager details are retrieved.
- The TAP is created as a secret in Delinea Secret Server through the REST API.
- A notification with a link to the exact secret is sent to the manager.
- The manager signs in to Secret Server, retrieves the TAP, and securely shares it with the new hire.
- The new hire signs in using TAP and registers approved password-less authentication methods.
Workflow Overview
This workflow is triggered when a new user account is created in Microsoft Entra ID.
It begins by generating a Temporary Access Pass (TAP) using Microsoft Graph APIs. The workflow then retrieves the user’s identity details and the associated manager’s information.
Once the required information is collected, the TAP is stored in Delinea Secret Server through the REST API, and an automated notification containing a link to that exact secret is sent to the manager for secure handoff to the new hire.
This approach reduces manual onboarding effort, minimizes dependency on temporary passwords, and helps accelerate password-less authentication adoption.
Figure 1: SailPoint ISC Workflow Overview
Configure Parameter Storage
Step 1: Configure Parameter Storage for Entra Authentication
- Log in to your SailPoint Identity Security Cloud tenant as an administrator.
- Navigate to Parameter Storage from the main administration menu.
- Select Create Parameter .
- Configure:
- Category: Authentication
- Type: OAuth 2.0 – Client Credentials Grant
- Save the parameter.
Figure 2: OAuth 2.0 Client Credentials Parameter Configuration
Important: Once a secure parameter is saved, its value cannot be viewed again. Store the secret securely outside of ISC before saving.
Step 2: Configure Parameter Storage for Microsoft Graph Scope
- Navigate to Parameter Storage .
- Select Create Parameter .
- Configure:
- Category: Authorization
- Type: OAuth 2.0 Scopes
- Use the Microsoft Graph scope:
https://graph.microsoft.com/.default
Figure 3: Microsoft Graph OAuth Scope Configuration
Build the Workflow
Step 1: Account Created Trigger
Configure an Account Created trigger.
Filter:
$.[?(@.source.name == 'Corporate Microsoft Entra ID')]
This ensures the workflow executes only when an account is created in the designated Microsoft Entra ID source.
Step 2: Generate Microsoft TAP
Add an HTTP Request V3 action.
Configuration:
| Setting | Value |
|---|---|
| Authentication Type | OAuth 2.0 Client Credentials |
| OAuth Parameter | Authentication Parameter Created Earlier |
| OAuth Scope Parameter | Scope Parameter Created Earlier |
| Method | POST |
| Content Type | JSON |
Request URL:
https://graph.microsoft.com/v1.0/users/{{$.trigger.account.attributes.userPrincipalName}}/authentication/temporaryAccessPassMethods
Request Body:
{
"isUsableOnce": true,
"lifetimeInMinutes": 1440
}
The request values should align with your organization’s TAP policy. One-time-use TAP is generally preferred for onboarding scenarios.
Figure 4: Generate Microsoft TAP Using Microsoft Graph
Step 3: Get User Identity Details
Add a Get Identity action.
Action Name:
Get User Identity Details
Configuration:
Identity: $.trigger.identity.id
Step 4: Get Manager Identity Details
Add another Get Identity action.
Action Name:
Get Manager Identity Details
Configuration:
Identity: $.getIdentity.managerRef.id
Step 5: Authenticate to Secret Server
Add an HTTP Request action that logs on to the Secret Server REST API and returns an access token.
Action Name:
Secret Server Logon
Configuration:
| Setting | Value |
|---|---|
| Method | POST |
| Content Type | application/x-www-form-urlencoded |
Request URL:
https://<tenant>.secretservercloud.com/SecretServer/oauth2/token
Request Body (form-encoded; reference the service account credentials:
grant_type=password&username=<secret-server-service-account>&password=<stored-in-parameter-storage>
The response returns an access_token. Reference it as a Bearer token in the Authorization header of the next steps. Configure this action so its request and response bodies are not logged.
Step 6: Create the TAP Secret
Add an HTTP Request action that creates the TAP secret in the onboarding folder.
Action Name:
Create TAP Secret
Configuration:
| Setting | Value |
|---|---|
| Method | POST |
| Content Type | JSON |
| Header | Authorization: Bearer {{$['HTTP Request - Secret Server Logon'].body.access_token}} |
Request URL:
https://<tenant>.secretservercloud.com/SecretServer/api/v1/secrets
Request Body:
{
"name": "TAP-${identityName}",
"secretTemplateId": <your-template-id>,
"folderId": <your-onboarding-folder-id>,
"siteId": 1,
"autoChangeEnabled": false,
"items": [
{
"fieldName": "Password",
"slug": "password",
"itemValue": "{{$['HTTP Request - Generate TAP'].body.temporaryAccessPass}}"
}
]
}
The response returns the secret object, including its id. The manager notification uses that id to link directly to the secret.
Step 7: Send Manager Notification
Add a Send Email action.
Recipient:
$.getIdentity1.attributes.email
Subject:
Temporary Access Pass Generated for ${identityName}
Email Body:
Dear Manager,
The account for your new hire has been successfully provisioned and a Microsoft Temporary Access Pass (TAP) has been generated to support their initial sign in and password-less authentication setup.
New Hire Details
Name: ${identityName}
Email: ${identityEmail}
Retrieving the Temporary Access Pass
For security, the TAP is not included in this email. It has been securely stored in Enterprise Secret Server. Sign in to retrieve it from the exact secret below:
https://<tenant>.secretservercloud.com/SecretServer/app/#/secrets/${secretId}/general
Validity: 24 Hours from Generation
Usage: One-Time Use Only
Action Required
After retrieving the TAP from Secret Server, securely share it with your new hire through an approved channel, such as in person or a verified phone call. Do not forward the TAP by email or chat.
New Hire Sign-In Instructions
1. Navigate to https://myaccount.microsoft.com
2. Sign in using your company email address: ${identityEmail}
3. When prompted for a password, select Use Temporary Access Pass
4. Enter the TAP code provided by your manager
5. Complete registration of the authentication method(s) approved by your organization
Once registration is complete, the employee should use their registered authentication method for all future sign-ins.
Thank you,
Identity & Access Management Team
Context:
{
"identityEmail.$": "$.getIdentity.attributes.email",
"identityName.$": "$.getIdentity.name",
"secretId.$": "$['HTTP Request - Create TAP Secret'].body.id"
}
The TAP value is never mapped into the email. Only the new hire’s name and email and the Secret Server secret id are mapped, and the email body builds the secret link from your tenant host. Replace <tenant> with your actual Secret Server tenant, and confirm the exact secret URL format for your tenant.
Step 8: Complete Workflow
Add a End Step - Success action.
Testing the Solution
After completing the workflow configuration, create a test user and verify the following:
- User account is created in Microsoft Entra ID source.
- SailPoint workflow executes successfully.
- Temporary Access Pass is generated.
- The TAP is created as a secret in the Secret Server onboarding folder, and a secret
idis returned. - Manager receives the onboarding notification, and the email contains the Secret Server link but not the TAP value.
- The manager can open the link, sign in to Secret Server, and retrieve the TAP, with the retrieval recorded in the Secret Server audit log.
- User can sign in using TAP.
- User successfully registers Microsoft Authenticator, FIDO2 Security Key, Windows Hello for Business, or another approved authentication method.
Successful completion should result in a password-less enabled user without requiring a temporary password.
Please see attached the JSON file for this Workflow. You may use it as a starting point and customize it further to meet your business requirements.
ISCGenerateMicrosoftTAPandStoreinDelineaSecretServer.json (8.7 KB)
Hybrid Environment Considerations
Many organizations continue to operate in hybrid identity environments where on-premises Active Directory remains the authoritative identity source.
While TAP works well for cloud-first onboarding scenarios, there are additional considerations:
- User synchronization from Active Directory to Entra ID must complete before TAP generation.
- Workflow execution may occur before the synchronized account becomes available in Entra ID.
- Retry logic should be implemented to account for synchronization delays.
- Azure Hybrid Joined devices may still require an Active Directory password for the initial workstation sign-in experience.
- If Password Writeback is enabled, TAP can be used to establish the initial password and synchronize it back to Active Directory.
The onboarding experience should be validated on managed devices and not only through browser-based sign-in scenarios.
Security Considerations
A Temporary Access Pass functions like a temporary credential, so it should be handled with the same level of care. Keep the following points in mind when implementing this solution:
-
Treat TAPs as sensitive credentials. Anyone who obtains a valid TAP can sign in as the new hire and register authentication methods. Limit who can generate TAPs, and make sure only the intended manager can retrieve the value.
-
Keep the lifetime short. Configure the shortest lifetime that still supports your onboarding process, and use one-time use (
isUsableOnce: true) wherever possible. -
Avoid exposure in logs and messages. Do not include the TAP value in email bodies, chat messages, or support tickets.
-
Validate Microsoft Graph permissions.
UserAuthenticationMethod.ReadWrite.Allis a high-privilege permission. Apply least privilege to the application, review ownership and consent regularly, and rotate the client secret. -
Validate TAP policy settings. Confirm that your Temporary Access Pass settings in the Authentication Methods policy (lifetime, one-time use, complexity, and assigned groups) align with current Microsoft Entra standards and your organization’s security requirements.
Lessons Learned
A few observations from implementing this solution:
- Account synchronization delays are one of the most common causes of TAP generation failures in hybrid environments.
- Secure delivery of the TAP often requires more planning than TAP generation itself.
- Clear onboarding instructions significantly reduce support requests from managers and new hires.
- Passwordless adoption increases when authentication method registration becomes part of the onboarding process.
- Device readiness matters. Test first sign-in on managed devices in addition to browser-based scenarios.
- Implement retry logic and account readiness checks to improve reliability in synchronized environments.
Conclusion
Password-less authentication is often viewed as a future initiative, but many organizations already have the building blocks available today.
By combining SailPoint ISC Workflows with Microsoft Temporary Access Pass, organizations can streamline first-day access, reduce dependency on traditional temporary passwords, and improve the onboarding experience for new employees.
For cloud-only environments, the implementation is relatively straightforward and can accelerate password-less adoption by guiding users through authentication method registration during onboarding. For organizations operating in hybrid Active Directory environments, additional planning around synchronization timing, password writeback, and device sign-in scenarios may be required, but the overall approach remains the same.
Whether your organization is cloud-first or hybrid, SailPoint ISC and Microsoft TAP provide a practical foundation for modern, secure, and user-friendly onboarding experiences.