A Temporary Access Pass (TAP) is a time-limited passcode that a user can use to sign in and register authentication methods, for example when the user has no password or has lost a device. For background, see Configure a Temporary Access Pass in Microsoft Entra ID. In Nerdio Manager you can control how passes are issued across your customers, and create a pass for an individual user, without leaving the portal.
This article explains how to set the Temporary Access Pass policy in the Entra ID Solution Baseline, so that the same policy applies to all assigned customers, and how to create a pass for a user. It is intended for MSP and account administrators.
The tasks in this article are performed at both MSP and Account levels.
The following Nerdio Manager roles allow you to manage Temporary Access Passes:
-
MSP Admins can configure the policy in the Entra ID Solution Baseline.
-
MSP Admins and Account Admins can create a pass for a user.
Following the Principle of Least Privilege (PoLP), you can define one or more Nerdio Manager custom role(s) with the access levels required to manage Temporary Access Passes:
-
To create a pass for a user who holds a Microsoft Entra admin role, the Accounts.AdminUsers.Update permission is required in addition to the permission to manage users. See Users and roles at the MSP level.
Creating passes and setting the policy use Microsoft Graph permissions that belong to the Entra permission set of the Nerdio Manager application, such as Policy.ReadWrite.AuthenticationMethod and UserAuthenticationMethod.ReadWrite.All. See Account-level Nerdio Manager service principal permissions.
The policy sets the lifetime and format of the passes that users can receive. Include it in your Entra ID Solution Baseline to apply the same policy to every assigned customer. For general steps for configuring the baseline, see Configure a solution baseline for Entra ID.
To set the Temporary Access Pass policy:
-
At the MSP level, navigate to Solution Baselines.
-
Locate the Entra ID solution baseline section, and from the action menu select Configure baseline.
-
Go to the Auth & Passwords step, and find the Temporary Access Pass Policy section.
-
Select the check box to enable the policy, and then enter the following information:
-
Minimum lifetime, Maximum lifetime, and Default lifetime: Enter a number for each, and select Minutes, Hours, or Days.
-
Passcode length: Enter the number of characters in a pass.
-
Require one-time use: Select Yes or No.
Note
The fields keep the lifetimes consistent. If the minimum lifetime is longer than the maximum, the maximum is raised. If the maximum is shorter than the minimum, the minimum is lowered. The default lifetime is kept within the range.
-
-
Select Enforce, Report-only, or Exclude for the policy, complete the remaining steps of the wizard, and save the baseline.
Result: with Enforce, the policy is applied to the assigned customers. In the baseline status, View Details shows the actual and the desired state. If someone changes the policy in the Microsoft Entra admin center, the status shows a Mismatch. The status is checked about every 60 minutes.
You can create a pass for a cloud user. The action is not available for users that exist only on-premises.
To create a Temporary Access Pass:
-
At the Account level, navigate to Entra > Users.
-
Locate the user, and from the user's menu select Create TAP.
-
When you are asked Create a Temporary Access Pass for user [Name]?, select OK.
-
Copy the pass by using the copy button. The dialog also gives a link to https://aka.ms/mysecurityinfo, which you can copy and send to the user.
Important
The pass can be viewed only once. If you close the dialog before you copy it, you must create a new pass.
-
Review the details that the dialog shows for the pass: Valid From, Valid Until, Created, One-time use, and Lifetime.
Result: the user can sign in with the pass at the sign-in page, and register authentication methods at the link above.
Contact our Sales team for more information about this feature.
Raise a support ticket about this feature.
Comments (0 comments)