{
  "id": "CB-M365-AUTH-017",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-017",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-017.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-017.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-017",
    "title": "Limit Temporary Access Pass to one-time use",
    "finding": {
      "title": "Temporary Access Passes can be used several times",
      "description": "A pass that stays valid for repeated sign-ins during its lifetime can be reused by anyone who intercepts it, for example from a help desk ticket or a chat message."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "temporary-access-pass",
      "onboarding",
      "passwordless",
      "authentication-methods"
    ],
    "description": "When the **Temporary Access Pass** method is enabled in the Authentication methods policy, its\nconfiguration has **One-time use** set to **Yes**, so every pass created in the tenant works for\na single sign-in, and **Maximum lifetime** stays at 8 hours or less.\n\nThe method itself is recommended: it is the safe way to register a first passkey or to recover\na user who lost every method. This control does not apply if the method is disabled.\n",
    "rationale": "A Temporary Access Pass satisfies MFA on its own. A reusable pass behaves like a strong\ncredential for its whole lifetime; a one-time pass limits the window to the registration it was\nissued for.\n",
    "impact": "A user whose registration fails half-way needs a new pass. Windows Autopilot and some device\nsetup flows sign in several times: issue a pass right before use, or scope a separate\nprocedure for them.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Authentication methods > Policies > Temporary Access Pass > Configure",
      "default_value": "One-time use No, maximum lifetime 8 hours",
      "recommended_value": "One-time use Yes, maximum lifetime 8 hours or less"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Authentication methods** > **Policies** and select **Temporary\n   Access Pass**.\n3. If it is enabled, open **Configure** and read **One-time use** and **Maximum lifetime**.\n4. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):\n   `Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId TemporaryAccessPass | Select-Object State -ExpandProperty AdditionalProperties`\n   (look at `isUsableOnce` and `maximumLifetimeInMinutes`).\n5. Fail if the method is enabled and **One-time use** is **No** (`isUsableOnce` is `false`),\n   or if the maximum lifetime exceeds 480 minutes.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy\n   Administrator.\n2. Browse to **Entra ID** > **Authentication methods** > **Policies** > **Temporary Access\n   Pass** > **Configure**.\n3. Set **One-time use** to **Yes**, keep **Maximum lifetime** at 8 hours or less, select\n   **Update**, then **Save**.\nGraph equivalent: `PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/TemporaryAccessPass`\nwith `{\"@odata.type\": \"#microsoft.graph.temporaryAccessPassAuthenticationMethodConfiguration\", \"isUsableOnce\": true}`.\n",
      "rollback": "Set **One-time use** back to **No**.\n"
    },
    "references": [
      {
        "title": "Configure a Temporary Access Pass in Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/identity/authentication/howto-authentication-temporary-access-pass",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-004",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-015",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-019",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}