My first experience with Temporary Access Pass during Windows Autopilot enrollment

Microsoft released some documentation regarding Temporary Access Pass and it states Windows Autopilot is not supported.

On several social media platforms, I saw the excitement about a new Azure AD feature Temporary Access Pass. And if you’re following the news about Passwordless stuff, you have probably also seen this kind of messages and already know where I`m talking about.

But if you haven’t heard, this is how Microsoft described TAP in the official documentation;

TAP is a time-limited passcode issued by an admin that satisfies strong authentication requirements and can be used to onboard other authentication methods, including Passwordless ones. TAP also makes recovery easier when a user has lost or forgotten their strong authentication factor like a FIDO2 security key or Microsoft Authenticator app, but needs to sign in to register new strong authentication methods.

With TAP we can provide a new user a Temporary Acess Pass (instead of a password). With that TAP, the user is able to sign-in to the My Security info portal, to register strong authentication methods, like the Authenticator app or a FIDO2 security key. This sounds pretty cool! Before this, the user always needed a password, at least for the very first sign-in to the Windows device, Office 365 etc.

As I`m working a lot with Endpoint Management (Intune), I off-course wondered how can TAP already be used for onboarding a new user who is provided a new Windows 10 device, which is enrolled using Windows Autopilot?

I can say, Yes it does! And here you can read my first experience with TAP and Windows Autopilot enrollment.

My setup

I created a completely new user (unfortunately still with an auto-generated password). I assigned a CA policy that is targeted to all cloud apps and the grant control is set to require MFA and a compliant device. This should completely block access to Office and the Security info portal for this user, as the user doesn`t have a compliance device (yet).

As test device, I spinned up a Hyper-V VM which is running a Windows 20H2 build and registered to Windows Autopilot.

Next, I needed to enable Temporary Access Pass in the Azure Portal and create a TAP using the Azure preview portal.

Enable Temporary Access Pass

To enable Temporary Access Pass, we can use the ‘ normal’ Azure portal. But at this moment to assign the user TAP as authentication method, we need to use the preview portal.

• Sign-in to the (preview) Azure portal
• Open Azure Active Directory
• Browse to Security – Authentication methods
• Select Temporary Access Pass (Preview)
• Set Enable to Yes
• Set Target to All users or a group of (pilot) users
• click Save

• Search for your pilot user in Azure AD (in the preview portal)
• Browse to Authentication methods
• Click Switch to the new user authentication methods…. in the purple notification

• Click + Add authentication method

• Choose Temporary Access Pass from the drop-down list
• Set the Delayed start time (optional)
• Set the Activation duration
• Set One-time use to No
• Click Add

The just created Temporary Access Pass is created.

We are ready to enroll a Windows 10 device using the Temporary Access Pass!

Windows Autopilot enrollment with a TAP

I started my Windows 10 test device which is registered to Windows Autopilot and like usual entered a user account.

In the next screen, we usually need to provide our password. But in this case, I was asked for the Temporary Access Pass.

After providing the TAP, the Autopilot enrollment is started.
When the device setup part is finished, the Windows Sign-in screen is shown.

This is where it’s getting interesting. Can we also sign-in to the device by entering the TAP instead of the password?
To be sure that I can use the TAP a second time (the first time was to start the enrollment), I already set the One-time use to No when I created the TAP.

The answer is NO.

To workaround this, I enabled Web Sign-in with an Intune profile setting.

Select the Web Sign-in icon (Globe) on the right and choose Sign in.

This will pop-up the Web sign-in screen, which allows us to enter an user account.

And after that, it allows us to enter the TAP.

It allows us to sign in and resume the Autopilot enrollment.

The Autopilot enrollment continues with the Account setup part.

As the enrollment is finished, we`re asked to setup Windows Hello.

And I`m signed in with my new user account, without using a password!

When I want to sign in to Office.com, I`m asked to register more (security) information.

As this device is marked as compliant, it allows me to register my Security information.

When this is finished, I can also, for example, register my FIDO2 security keys as authentication method.

This was my first experience with Temporary Access Pass in combination with Windows Autopilot. Leave a comment or reach out to me on social media, to share your experience with Temporary Access Pass!

And if you’re interested in more passwordless related articles have a look at this overview.