entra temporary access pass expired before the user redeems it

TL;DR

A Temporary Access Pass has a fixed lifetime and is single-use by default. Revoke the expired pass, create a new one with a lifetime that covers the user's actual setup window, and have them redeem it promptly.

The query

entra temporary access pass expired before the user redeems it

Use this when

• the user reports the temporary access pass expired
• onboarding stalled because the TAP window was missed
• a helpdesk-issued TAP was never redeemed in time

Not for

• TAP redemption blocked by conditional access policy
• users who need a long-lived credential instead of a TAP
• passwordless phone sign-in setup issues

Steps

1. In Entra ID, open the user's Authentication methods and confirm the TAP shows expired or already used. Expected output: the TAP state is visible and clearly not redeemable.
2. Delete or revoke the expired TAP so it cannot confuse the user later. Expected output: no active TAP remains on the account.
3. Create a new Temporary Access Pass with a lifetime that covers the setup window, such as 8 hours for same-day onboarding. Expected output: a new one-time passcode is displayed.
4. Share the passcode with the user through a verified channel and confirm their identity per your policy. Expected output: the user receives the code and you have an identity-verification record.
5. Have the user sign in and redeem the pass immediately, then confirm they completed MFA registration. Expected output: the account shows fresh registered auth methods.

Applies to

Microsoft Entra ID Temporary Access Pass, Entra admin center, current portal versions. Requires an admin role that can manage authentication methods.

Variant phrasings

User needs the TAP for a multi-day rollout

Issue with the maximum allowed lifetime and schedule a check-in; do not share one TAP across users.

TAP redeemed but MFA setup still incomplete

The TAP did its job; continue with normal authenticator enrollment while the session is fresh.

Why it happens

TAPs are intentionally short-lived and single-use to limit exposure. Missed windows are an operational issue, not a product bug, so reissue with a realistic lifetime.

Edge cases

• Never email a TAP to an unverified address; confirm identity first, especially for privileged accounts.
• A TAP can satisfy MFA requirements, so treat its issuance like a credential reset.
• Audit who issued each TAP; the admin center logs this automatically.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstEXWpRPkeT1rgdDzM_krnA

Resolved from the public thread: https://vectle.com/posts/pstEXWpRPkeT1rgdDzM_krnA

Thread query: entra temporary access pass expired before the user redeems it

TL;DR: A Temporary Access Pass has a fixed lifetime and is single-use by default. Revoke the expired pass, create a new one with a lifetime that covers the user's actual setup window, and have them redeem it promptly.