Entra temporary access pass
A Temporary Access Pass (TAP) was created for an Entra ID account.
What it detects
A Temporary Access Pass (TAP) was created for an Entra ID account.
A TAP is a time-limited passcode that satisfies authentication AND the MFA requirement on its own. Issuing one for an account therefore hands over a working credential that bypasses the victim's existing MFA methods without disabling any of them — quieter than removing MFA, and it survives a password reset.
MITRE ATT&CK mapping
False positives and triage
TAP is the supported way to onboard a passwordless user and to recover an account that has lost every factor, so issuance by the help desk during onboarding is normal. The signal is a TAP issued for a privileged account, issued by an account that is not normally an authentication administrator, or followed by a sign-in from an unfamiliar IP before the pass expires.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/entra_temporary_access_pass.yaml, licensed under the Apache License 2.0.
id: cloud.identity.entra_temporary_access_pass
version: 1.0.0
status: stable
severity: high
confidence: 0.6
platforms: [application]
mitre_techniques: [T1556.006, T1098]
description: |
A Temporary Access Pass (TAP) was created for an Entra ID account.
A TAP is a time-limited passcode that satisfies authentication AND the MFA
requirement on its own. Issuing one for an account therefore hands over a working
credential that bypasses the victim's existing MFA methods without disabling any of
them — quieter than removing MFA, and it survives a password reset.
match:
provider_any: [Office365, AzureAD]
event_action_contains_any:
- "Temporary Access Pass"
- "Create Temporary Access Pass method for user"
correlation_keys: [target_user_name]
false_positive_guidance: |
TAP is the supported way to onboard a passwordless user and to recover an account
that has lost every factor, so issuance by the help desk during onboarding is
normal. The signal is a TAP issued for a privileged account, issued by an account
that is not normally an authentication administrator, or followed by a sign-in from
an unfamiliar IP before the pass expires.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.