This guide explains what a Temporary Access Pass (TAP) is and how to use it. It also covers, at a high level, what is required to turn the feature on for your organization.
Overview
A Temporary Access Pass (TAP) is a short-lived, one-time passcode you can use instead of your password to sign in. eADM uses it to let you register a new sign-in method yourself, for example the Microsoft Authenticator app or a security key, without contacting your IT support.
|
Item |
Detail |
|---|---|
|
Where you see it |
A TAP tab next to Password in the self-service password portal, if your organization has enabled this feature for you |
|
How long it lasts |
10 minutes, and it can only be used once |
|
What it's for |
Registering a new sign-in method, not everyday sign-in |
Note: If you don't see a TAP tab in the password portal and believe you should, contact your organization's IT support or your Identum partner.
How to use it
-
Open the self-service password portal and go to the TAP tab.
-
Click Request Temporary Access Pass. A one-time passcode appears, with a countdown showing how long it's valid.
-
Go to https://mysignins.microsoft.com/security-info and sign in using the passcode instead of your password.
-
Register your new sign-in method (Authenticator app, security key, etc.) while signed in.
The passcode expires after 10 minutes and can only be used once. If it expires before you finish, request a new one.
Setting up TAP for your organization
This section requires Organization Admin (Partner Administrator) access. Turning TAP on involves changes in both Microsoft Entra and eADM, and is available to Identum partners and select customers with the right technical access. If this doesn't describe you, please contact your partner or Identum support to have TAP enabled for your organization, don't attempt the steps below yourself.
1. Enable TAP in Microsoft Entra
In the Entra admin centre, under Authentication methods, Policies, Temporary Access Pass, turn the method on for the intended users or groups. Make sure the tenant's allowed lifetime range includes 10 minutes. eADM always requests a 10-minute, one-time-use pass.
2. Grant the Microsoft Graph API permission
The Azure app registration eADM uses for synchronization needs one additional Microsoft Graph application permission:
|
Permission |
Type |
|---|---|
|
|
Application |
Add it under API permissions on the app registration and grant admin consent. The permission has no effect until consent is granted. Without it, every TAP request is rejected.
3. Enable the setting in eADM
Set Allow temporary access pass = true on your organization's Entra synchronization step in eADM (your partner or Identum support can do this for you).
4. Review Conditional Access, your responsibility
Your organization's Conditional Access policies live entirely inside your own Entra tenant. Identum has no visibility into them and cannot configure or troubleshoot them on your behalf. If you enforce phishing-resistant MFA (e.g. FIDO2/Passkeys, Authenticator) for everyday sign-in, make sure your policies still accept a TAP for the Register security information action, and specifically test the flow for a user who already has an old method on record, not just a brand-new user. Otherwise the TAP tab can appear to do nothing, or a user recovering a lost device can get stuck in a loop being asked for the very method they lost.
Your partner or Identum support can point you to detailed technical guidance for all of the above, but the Conditional Access design and testing itself is done within your own tenant, by your own Entra administrators.
Related articles