Limit Temporary Access Pass to one-time use

Description

When the Temporary Access Pass method is enabled in the Authentication methods policy, its configuration has One-time use set to Yes, so every pass created in the tenant works for a single sign-in, and Maximum lifetime stays at 8 hours or less.

The method itself is recommended: it is the safe way to register a first passkey or to recover a user who lost every method. This control does not apply if the method is disabled.

Rationale

A Temporary Access Pass satisfies MFA on its own. A reusable pass behaves like a strong credential for its whole lifetime; a one-time pass limits the window to the registration it was issued for.

Impact

A user whose registration fails half-way needs a new pass. Windows Autopilot and some device setup flows sign in several times: issue a pass right before use, or scope a separate procedure for them.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Authentication methods > Policies and select Temporary Access Pass.
3. If it is enabled, open Configure and read One-time use and Maximum lifetime.
4. Read-only alternative with Microsoft Graph PowerShell (scope Policy.Read.All): Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId TemporaryAccessPass | Select-Object State -ExpandProperty AdditionalProperties (look at isUsableOnce and maximumLifetimeInMinutes).
5. Fail if the method is enabled and One-time use is No (isUsableOnce is false), or if the maximum lifetime exceeds 480 minutes.

Remediation

1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
2. Browse to Entra ID > Authentication methods > Policies > Temporary Access Pass > Configure.
3. Set One-time use to Yes, keep Maximum lifetime at 8 hours or less, select Update, then Save. Graph equivalent: PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/TemporaryAccessPass with {"@odata.type": "#microsoft.graph.temporaryAccessPassAuthenticationMethodConfiguration", "isUsableOnce": true}.

Rollback

Set One-time use back to No.

References

• Configure a Temporary Access Pass in Microsoft Entra ID Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-004 Require phishing-resistant MFA for administrative roles
• related CB-M365-AUTH-015 Enable passkeys and enforce attestation for administrators
• related CB-M365-AUTH-019 Protect security information registration with a managed device or MFA

People and lifecycle