Finish passwordless registration within 10 minutes of signing in with a single-use Temporary Access Pass (TAP); that timing is the core check.
Key takeaways
- Complete registration within 10 minutes. When a new hire enters a single-use Temporary Access Pass to register a passwordless authentication method, the process must finish within 10 minutes of sign-in, according to Microsoft Learn.
- Prepare a second pass for slow enrollments. If device enrollment reaches the Windows Hello for Business registration step after more than 10 minutes, you must provide a second single-use TAP to register the credential, according to Microsoft Learn.
- Authenticate first on joined devices. On already-joined devices, the user must first authenticate with another method such as a password, smartcard, or FIDO2 key before using TAP to set up Windows Hello for Business, according to Microsoft Learn.
- Register a passwordless method. Once signed in, the user can update or register a method such as a FIDO2 security key, according to Microsoft Learn.
- Keep the authenticator backup. If your office uses 1Password two-factor authentication, 1Password says the backup it shows will be your backup if you lose access to your authenticator app, according to 1Password.
Temporary access pass for new hires: the short answer
When using a one-time TAP to register a passwordless method such as a FIDO2 security key or phone sign-in, the user must complete the registration within 10 minutes of sign-in with the one-time TAP, according to Microsoft Learn. This timing rule applies specifically to the registration process for passwordless methods initiated with a Temporary Access Pass. The 10-minute window starts at the moment the new hire signs in using the TAP and ends when the registration of the new authentication method is finished.
Before sign-in: what to prepare for the new hire
Verify the device join status before the new hire begins their first sign-in. Users with a Temporary Access Pass can navigate the setup process on Windows 10 and 11 to perform device join operations and configure Windows Hello for Business, according to Microsoft Learn. Confirm the laptop is running a supported version of Windows so the new hire can complete these specific device operations. If your office uses 1Password for credential management, check the application version on the new hire’s device before they start. Two-factor authentication requires a 1Password membership and 1Password 7 or later, according to 1Password. Ensure the software is updated to version 7 or later if you plan to enable two-factor authentication for the new account.
Limit access to the new hire’s credentials and physical workspace to authorized personnel. One of the best ways to protect information or physical property is to ensure that only authorized people have access to it, according to CISA. Review who in your office has physical or digital access to the new hire’s login details. Restrict this access to the new hire and the specific IT staff members assisting with the setup. Do not share the Temporary Access Pass or any generated codes with other employees. Keep the physical laptop in a secure location until the new hire is present. If you also plan to restore the new hire's files, see Recover old office files: 4 backup tools compared.
Prepare the environment for the specific authentication methods you intend to use. If you are using a FIDO2 security key, have the physical key ready. If you are using a mobile authenticator app, ensure the new hire has a compatible smartphone. Verify that the network connection is stable and capable of supporting the registration process. Check that the new hire’s account exists in your identity provider before distributing the Temporary Access Pass. Confirm that the device is not locked by any local security policies that might interfere with the join process.
During sign-in: registration and joined-device checks
The critical constraint during the new hire's first sign-in is the timing of the passwordless registration. When users enter a single-use Temporary Access Pass (TAP) to register a passwordless authentication method, the registration must be completed within 10 minutes of sign-in, according to Microsoft Learn. This 10-minute requirement relates to MFA enforcement during credential registration, but not TAP specifically, according to Microsoft Learn. Therefore, the clock starts when the user signs in with the TAP and stops when the new authentication method is fully registered.
If the device enrollment process reaches the Windows Hello for Business registration step after more than 10 minutes, a second single-use TAP must be provided to register the credential, according to Microsoft Learn. This scenario often occurs if the initial device setup takes longer than expected. The 10-minute MFA requirement effectively restarts when the user begins to register the new authentication method, according to Microsoft Learn. This means that if the first TAP is used for the initial sign-in and the registration of the new method begins later, a fresh 10-minute window applies to that specific registration action.
Device join status dictates the authentication sequence. On already-joined devices, users must first authenticate with another method such as a password, smartcard, or FIDO2 key, before using TAP to set up Windows Hello for Business, according to Microsoft Learn. For hybrid-joined devices, users must first authenticate with another method such as a password, smartcard or FIDO2 key, before using TAP to set up Windows Hello for Business, according to Microsoft Learn.
Verify the device join status before handing over the laptop. If the device is already joined or hybrid-joined, confirm the new hire has a valid password, smartcard, or FIDO2 key available for the initial authentication. If the device is not yet joined, ensure the TAP is ready for immediate use at the first sign-in prompt. If the enrollment process is likely to exceed 10 minutes, have a second single-use TAP generated and ready to provide if the Windows Hello for Business registration step is reached after the initial window closes. Time the enrollment process to determine if a second TAP is necessary.
Illustrative example: a slow enrollment
A new hire signs in with a single-use TAP and starts registering a FIDO2 key. Device enrollment runs for 15 minutes before the Windows Hello for Business step appears. Because that is more than 10 minutes, the helper hands over a second single-use TAP that was generated in advance. The new hire enters it, and the credential registration finishes without a restart of the whole setup. The numbers here are illustrative only.
After setup: authenticator backup and access checks
Once the new hire is signed in, the immediate task is to register a permanent authentication method. The user is now signed in and can update or register a method such as a FIDO2 security key, according to Microsoft Learn. This step replaces the temporary access pass with a durable credential. For organizations that follow NIST standards for onboarding and recovery, the relevant guidance is found in NIST Special Publication 800-63A, according to Microsoft Learn. Confirm that your internal recovery procedures align with this publication before the new hire leaves the setup desk.
If your office uses 1Password for credential management, you can also have the new hire enable two-factor authentication for their 1Password account. After scanning the QR code, the user will see a six-digit authentication code, according to 1Password. The user then enters this six-digit authentication code and selects Confirm, according to 1Password. 1Password says this will be your backup if you lose access to your authenticator app, according to 1Password. Do not rely on the temporary access pass for long-term access; once a permanent method is registered, the new hire should use that method.
Verify that the new hire can sign in to their primary applications using the newly registered FIDO2 key. Check that the passwordless method is listed as active in the identity provider’s user profile. If you use a password manager rollout, review Password manager rollout: 3 checks before close to ensure the new hire’s account is fully configured. The goal is to confirm that the new hire no longer depends on the temporary access pass for daily access.
Temporary access pass reference table: limits by publisher
The following table summarizes the specific rules and limits documented by each publisher regarding Temporary Access Pass usage, device enrollment timing, and two-factor authentication requirements.
| Publisher | Rule or limit | Source quote |
|---|---|---|
| Microsoft Learn | Registration must be completed within 10 minutes of sign-in when using a single-use TAP to register a passwordless authentication method. | "Note: When users enter a single-use TAP to register a passwordless authentication method, the registration must be completed within 10 minutes of sign-in." according to Microsoft Learn |
| Microsoft Learn | If device enrollment takes longer than 10 minutes, users need to enter a second single-use TAP for passwordless credential registration. | "If your organization enforces single-use TAPs, and the overall device enrollment process takes longer than 10 minutes, users need to enter a second single-use TAP for their passwordless credential registration." according to Microsoft Learn |
| Microsoft Learn | On already-joined devices, users must first authenticate with another method such as a password, smartcard, or FIDO2 key before using TAP to set up Windows Hello for Business. | "On already-joined devices, users must first authenticate with another method such as a password, smartcard, or FIDO2 key, before using TAP to set up Windows Hello for Business." according to Microsoft Learn |
| 1Password | Two-factor authentication requires a 1Password membership and 1Password 7 or later. | "Two-factor authentication requires a 1Password membership and 1Password 7 or later." according to 1Password |
| 1Password | After setup, 1Password says this will be your backup if you lose access to your authenticator app. | "This will be your backup if you lose access to your authenticator app." according to 1Password |
| CISA | One of the best ways to protect information or physical property is to ensure that only authorized people have access to it. | "One of the best ways to protect information or physical property is to ensure that only authorized people have access to it." according to CISA |
Verify the specific version of your identity provider and password manager against these limits before issuing the first pass.
First sign-in checklist: the 6 checks for one new hire
Use this checklist for each new hire. The six rows correspond to the documented requirements for Temporary Access Pass usage and device rules.
| Check | What to verify |
|---|---|
| 1. Registration timing | Registration finishes within 10 minutes of sign-in with the one-time TAP. |
| 2. Second pass ready | A second single-use TAP is ready if device enrollment may take longer than 10 minutes. |
| 3. Joined or hybrid-joined device | The new hire can first authenticate with a password, smartcard or FIDO2 key before using TAP to set up Windows Hello for Business. |
| 4. Windows version | The laptop runs Windows 10 or 11 for device join and Windows Hello for Business setup. |
| 5. Permanent method | After sign-in, the new hire registers a method such as a FIDO2 security key. |
| 6. Restricted access | Only authorized people have access to the new hire’s credentials and laptop. |
Next step to take today
Before the next start date, confirm the new hire's device join status and generate a second single-use TAP. After setup, have the new hire sign out and back in using only the newly registered passwordless method to confirm that it works.
FAQ: Temporary access pass at first sign-in
How do I use a Temporary Access Pass for a new hire sign-in?
Use a single-use TAP to sign in, then complete passwordless registration within 10 minutes.
How long does a new hire have to register after a single-use TAP?
Registration must be completed within 10 minutes of sign-in with the one-time TAP, according to Microsoft Learn.
What if device enrollment takes longer than 10 minutes?
Give the new hire a second single-use TAP.
Does TAP work on a hybrid-joined PC without another sign-in first?
No. On already-joined devices, users must first authenticate with another method such as a password, smartcard, or FIDO2 key, before using TAP to set up Windows Hello for Business, according to Microsoft Learn.
Can a new hire set up 1Password two-factor with an authenticator app on their phone?
Yes, with 1Password 7 or later. After you scan the QR code, you’ll see a six-digit authentication code, according to 1Password. Enter the six-digit authentication code, then select Confirm, according to 1Password.