Please be sure you’ve read the docs and API specs before asking for help. Also, please be sure you’ve searched the forum for your answer before you create a new topic.
Hi All,
We are currently exploring the implementation of Microsoft Temporary Access Pass (TAP) functionality for new joiners and would appreciate some guidance from anyone who has implemented a similar solution.
Our objective is to allow new joiners to complete their initial account setup without sharing an initial password. The proposed flow is:
Two days before the joining date, generate a Temporary Access Pass (TAP) using Microsoft Graph API.
On the start date, enable the user’s Entra ID account.
User signs in to the Microsoft Security Portal using TAP.
User is able to register MFA methods.
This works successfully, and the user can voluntarily register MFA.
User is then required to set up their password.
The challenge we are facing is during the password setup step. When the user selects “Forgot password” to set their password, SSPR requires a second authentication method, which appears to be the password itself. Since we are not sharing an initial password with the user, the process cannot be completed.
Our current TAP configuration:
TAP is generated 2 days before the user’s start date.
TAP is used for initial authentication.
MFA registration is completed using TAP.
TAP expires after 2 hours.
Has anyone implemented Microsoft TAP for new joiners in a similar scenario?
We would appreciate any guidance on the recommended approach for enabling users to securely set their password after registering MFA with TAP, especially in a hybrid identity environment.
Other option could be, to share the initial temp password via a verified phone e.g send them a welcome email with their username and a link to the login portal but deliver the temp password through a completely separate channel. You can either text it to their mobile number or have the helpdesk team read it to them over the phone, making sure to set the account to force a password change on their first login. For this approach, you will need to get their valid phone number as part of the onboarding process.
There are two typical hurdles / considerations with TAP, you just need to see how you want these hurdles to be covered (appetite / taste):
You need a flow for expired TAP handling. (e.g. How can the end-user request another TAP?)
TAP delivery channel identity verification. (e.g. Help desk - At a bootstrapping stage, how can help desk validate the caller is who they claim they are. What’s the level of assurance you need?)
We are also using TAP implementation but haven’t come across this issue. In our case, the TAP is generated 2 days prior and is valid for 2 days. Once user logins with TAP they navigate to Change Password option on the Security Info portal and are able to set the password.
I would suggest verify your setup and configurations using the below link as references:
Thanks for your message. I believe our SSPR configuration is restricting password change functionality until 2 authentication methods are registered by user. How you achived password reset using TAP.
In our case we have enforced an SSPR Registration Policy, so the user will automatically be interrupted and forced to register two methods immediately upon entering with the TAP.
You can setup any 2 required SSPR methods (e.g., Microsoft Authenticator app, Phone number, FIDO2 Key, or Email) and then they should be able to change the Password.
We have a transform for lifecycle that switches identity into Active state only when start date = current date. Then we trigger our TAP provisioning workflow only when lifecycle is changed from anything to active. We also use the TAP delayed start. So, if we provision TAP at 2AM and TAP lifetime is 8H, then we set “startDateTime”: “2026-07-10T10:10:00Z”. The start date time would probably be an option for you too, if you have a fixed time for TAP provisioning.
Hi Sharvari, Thanks for your input. Please can you share more details on SSPR Registration Policy, I will check with EntraID team to configure similar.
Hi Bharani, Thanks for your inputs. Currently are in Hybrid AD environment and we don’t have any PAM solution, So we are left with option either to send from workflow or from IQService (AfterCreate rule - However we need to make sure EntraID account is created before creating PAT).
Hi @248048 - Once a Temporary Access Pass (TAP) is enabled for a user, they can open the Microsoft Authenticator app and complete the registration process using the TAP. After the Authenticator app has been successfully registered, the user can reset or update their password. If your organization supports passwordless authentication, they can also configure passwordless sign-in using the Authenticator app.
In my opinion, this is something you should try and solve it from Entra end. The fact that user has to enter their password in order to complete MFA, seems to be like some misconfiguration on Entra end. Ideally as other colleagues mentioned, it should be validated by either phone number of email address.
Hi Vikas, Thanks for your message. Had troubleshooting session with EntraID team and found that one of the conditional access policy was restricting the SSPR when use is logged in using TAP.
Please be sure you’ve read the docs and API specs before asking for help. Also, please be sure you’ve searched the forum for your answer before you create a new topic.