About Microsoft Entra Temporary Access Pass
Microsoft Entra supports a Temporary Access Pass (TAP). A TAP is a time-limited passcode. It lets a user sign in when they cannot use their usual authentication methods, for example after they lose their phone or forget their security key. After the user signs in, they can register new methods. An administrator creates the pass and gives it to the user. Thus, your helpdesk must first confirm the identity of the person who asks for it.
With Persona, the employee proves their identity with a government ID and selfie verification. Persona compares the name on the ID with the Entra profile of the employee. Only then does Persona create the Temporary Access Pass and show it to the employee. This helps protect account recovery against social engineering, deepfakes, and account takeover. Also, your helpdesk never touches the pass.
How it works
- Your helpdesk sends the employee a Persona verification link.
- Persona looks up the employee in Microsoft Entra by their user principal name (UPN).
- The employee completes a government ID and selfie verification. Persona compares the government ID with the employee’s Entra profile.
- If the verification passes, Persona creates a Temporary Access Pass in Microsoft Entra and shows it on the final screen.
- The employee signs in to Microsoft with the pass and registers a new authentication method.
Use a Persona organization that is only for your workforce. Keep it separate from all organizations that verify your customers. This keeps employee data and customer data apart. If you do not have a workforce organization yet, ask your Persona contact.
Microsoft Entra Configuration Guide
Do the steps below to issue Microsoft Entra Temporary Access Passes with Persona. The Microsoft Entra Temporary Access Pass wizard in the Persona Dashboard shows you the same steps. It also checks your configuration at each step.
1. Configure Persona Marketplace Integration for Employee Data
Context
Persona requires access to your Microsoft Entra tenant through Microsoft Graph. Persona uses this access to find the employee and to create their Temporary Access Pass.
Persona must make sure that the employee in the verification is the person who owns the Entra account to recover. To do this, Persona compares the values from the government ID of the employee with the given name and surname in their Entra user profile.
Make sure that the names in Entra are the legal names of employees, not preferred names or nicknames.
Connect Microsoft Entra
- Use Connect Microsoft Entra ID to your Persona account to add a credential. In the Persona Dashboard, add it under Integrations > Marketplace > Microsoft Entra ID.
- Connect with an Entra administrator who can create a Temporary Access Pass for the employees in scope. An Authentication Administrator can create passes for members. A Privileged Authentication Administrator can also create them for administrators. Persona creates each pass as this administrator. Entra does not create a pass for the account of that administrator.
- Click Test to check the connection before you continue.
2. Turn on the Temporary Access Pass method in Microsoft Entra
Persona cannot create a pass until the method is on for the employee.
- In the Microsoft Entra admin center, go to Entra ID > Authentication methods > Policies and select Temporary Access Pass.
- Select Enable. First include a pilot group. Then include all users who may recover this way.
- Select Configure and set the default lifetime. Persona creates passes with the default lifetime.
- Keep One-time off, unless you want all passes in your tenant to be one-time. Persona asks for one-time passes in both cases.
- Select Save.
3. Configure the Persona inquiry template
Persona gives a ready-made inquiry template for this flow. It includes the workflows that find the employee and create the pass. The wizard installs it in your workforce organization and applies your answers to it. Before you publish, check these items:
- In the two Find or Create Account steps and the Fetch Account Object step, select your account type.
- In the two Get Entra User steps and the Create temporary access pass step, select the Microsoft Entra credential from Step 1.
- Review the success and failure workflows. They send an email to the employee when an inquiry completes or fails. They send an email to your administrators when Persona cannot find the employee in Entra after many attempts. Change the recipients and contact addresses to your own.
- Publish the verification templates first. Then publish the workflows. Then publish the inquiry template.
4. Start account recovery for an employee
Microsoft Entra does not automatically send a locked-out employee to Persona. Thus, your helpdesk starts recovery.
- In the Persona Dashboard, go to Inquiries and create an inquiry from the installed template.
- Set the Reference ID to the user principal name of the employee, or set the account type to No Account. If you do not, the inquiry creates a second account for the employee. Then Persona cannot identify repeat attempts. If you do not set either one, the employee enters their user principal name in the flow.
- Send the employee the inquiry link.
When the employee passes, the final screen shows their Temporary Access Pass and a link to sign in to Microsoft. The screen shows the pass only one time. If the employee leaves the screen and does not copy the pass, they need a new inquiry.
5. Test the integration
- Send an inquiry to a test employee and complete it.
- Make sure that the final screen shows a Temporary Access Pass.
- Use the pass to sign in at Security info as the test employee. Register a new authentication method.
- Also test the failure path. Fail an inquiry on purpose. Make sure that Persona does not create a pass.
Microsoft Entra does not let an administrator create a Temporary Access Pass for their own account. Thus, a test with the administrator who connected the integration fails. Test with a different user.
Related resources
- Microsoft Entra integration overview
- Using Persona Workflows to manage Microsoft Entra users & profiles
- Microsoft Learn: Configure Temporary Access Pass to register passwordless authentication methods
Plans Explained
Microsoft Entra Integration by plan
| Startup Program | Essential Plan | Growth Plan | Enterprise Plan | |
|---|---|---|---|---|
| Microsoft Entra Integration | Not Available | Not Available | Limited | Available |