{"id":1938,"date":"2026-05-18T21:44:46","date_gmt":"2026-05-18T21:44:46","guid":{"rendered":"https:\/\/www.ultrexstaff.com\/?p=1938"},"modified":"2026-05-18T21:44:46","modified_gmt":"2026-05-18T21:44:46","slug":"using-web-sign-in-with-tap","status":"publish","type":"post","link":"https:\/\/www.ultrexstaff.com\/?p=1938","title":{"rendered":"Using Web sign in with TAP"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\">Passwordless Login to Entra-Joined Devices Using a Temporary Access Pass (TAP)<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">TL;DR<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Run this command on an Entra-joined Windows device (elevated Command Prompt), reboot, enable TAP in the Entra admin center, issue a passcode, and your user is one globe-icon-click away from a passwordless sign-in:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">reg add HKLM\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\Authentication \/v EnableWebSignIn \/t REG_DWORD \/d 1 \/f<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">Handing a user a short-lived passcode that gets them straight to the Windows desktop \u2014 no password, no MFA prompt, no helpdesk back-and-forth \u2014 is one of the cleanest workflows Microsoft has shipped in years. The trick is pairing a <strong>Temporary Access Pass (TAP)<\/strong> from Microsoft Entra ID with the <strong>Web Sign-in<\/strong> credential provider in Windows.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This walkthrough covers the whole flow: flipping on Web Sign-in with a single registry command, enabling the TAP policy in Entra, issuing the passcode, and logging in on the device.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">What You&#8217;ll Need<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A <strong>Microsoft Entra joined<\/strong> device (this does <em>not<\/em> work on Hybrid Joined or AD-only machines)<\/li>\n\n\n\n<li><strong>Windows 11 22H2 with KB5030310 or later<\/strong> (Windows 10 1809+ works for Web Sign-in but Windows 11 is strongly preferred)<\/li>\n\n\n\n<li><strong>Microsoft Entra ID P1<\/strong> license or higher for the user<\/li>\n\n\n\n<li>One of these admin roles to issue the TAP: <strong>Global Administrator<\/strong>, <strong>Privileged Authentication Administrator<\/strong>, or <strong>Authentication Administrator<\/strong><\/li>\n\n\n\n<li><strong>Authentication Policy Administrator<\/strong> role to configure the TAP policy itself<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Enable Web Sign-in on the Device<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Web Sign-in is the credential provider that puts the little globe icon on the Windows lock screen. Without it, the device has nowhere to accept a TAP code at sign-in time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Open an <strong>elevated Command Prompt<\/strong> (Run as administrator) on the target device and run:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">reg add HKLM\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\Authentication \/v EnableWebSignIn \/t REG_DWORD \/d 1 \/f<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That&#8217;s it. What this does:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>HKLM\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\Authentication<\/strong> is the policy location Windows reads at sign-in<\/li>\n\n\n\n<li><strong>EnableWebSignIn<\/strong> is the value name that toggles the Web Sign-in credential provider<\/li>\n\n\n\n<li><strong>REG_DWORD \/d 1<\/strong> sets it to enabled (use 0 to disable later)<\/li>\n\n\n\n<li><strong>\/f<\/strong> is force, no confirmation prompt<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Reboot the device<\/strong> for the change to take effect. After it comes back up, you&#8217;ll see a new sign-in option on the lock screen \u2014 a small globe icon under &#8220;Sign-in options.&#8221;<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Doing this at scale?<\/strong> The registry command is great for testing, recovery, or a single device. For fleet-wide deployment, push the equivalent setting through Intune: <strong>Devices \u2192 Configuration \u2192 Create \u2192 Settings catalog \u2192 Authentication \u2192 Enable Web Sign In \u2192 Enabled<\/strong>. Same outcome, but managed centrally and survives device wipes.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Enable the Temporary Access Pass Policy in Entra<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">TAP is off by default in the tenant. Turn it on:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to the <strong>Microsoft Entra admin center<\/strong> at entra.microsoft.com<\/li>\n\n\n\n<li>Navigate to <strong>Protection \u2192 Authentication methods \u2192 Policies<\/strong><\/li>\n\n\n\n<li>Click <strong>Temporary Access Pass<\/strong><\/li>\n\n\n\n<li>Switch <strong>Enable<\/strong> to <strong>On<\/strong><\/li>\n\n\n\n<li>Under <strong>Target<\/strong>, choose <strong>All users<\/strong> or scope to a specific group (recommended for pilots)<\/li>\n\n\n\n<li>Click the <strong>Configure<\/strong> tab and set:\n<ul class=\"wp-block-list\">\n<li><strong>Minimum lifetime<\/strong>: 1 hour<\/li>\n\n\n\n<li><strong>Maximum lifetime<\/strong>: 8 hours (this is the hard ceiling Microsoft allows)<\/li>\n\n\n\n<li><strong>Default lifetime<\/strong>: 1 hour<\/li>\n\n\n\n<li><strong>One-time use<\/strong>: <strong>No<\/strong> if the device will reboot during setup, <strong>Yes<\/strong> for tighter security<\/li>\n\n\n\n<li><strong>Length<\/strong>: 8 characters minimum<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Click <strong>Save<\/strong><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Replication can take a few minutes. If a TAP prompt doesn&#8217;t appear right away, give it 5\u201310 minutes.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Issue a TAP to the User<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the Entra admin center, go to <strong>Identity \u2192 Users \u2192 All users<\/strong><\/li>\n\n\n\n<li>Find and click the user<\/li>\n\n\n\n<li>Open <strong>Authentication methods<\/strong> in the left menu<\/li>\n\n\n\n<li>Click <strong>+ Add authentication method<\/strong><\/li>\n\n\n\n<li>From the dropdown, choose <strong>Temporary Access Pass<\/strong><\/li>\n\n\n\n<li>Set the <strong>activation time<\/strong>, <strong>lifetime<\/strong>, and <strong>one-time use<\/strong> preference<\/li>\n\n\n\n<li>Click <strong>Add<\/strong><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Entra will display the passcode <strong>exactly once<\/strong>. Copy it now \u2014 once you close the window, it&#8217;s gone. Hand it to the user through a secure channel (in person, a phone call, or a verified secure messaging tool \u2014 not plain email).<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Sign In to the Device With the TAP<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On the Windows lock screen:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Click <strong>Sign-in options<\/strong> below the password field<\/li>\n\n\n\n<li>Click the <strong>globe icon<\/strong> (Web Sign-in)<\/li>\n\n\n\n<li>Click <strong>Sign in<\/strong><\/li>\n\n\n\n<li>Enter the user&#8217;s UPN (e.g., jane.doe@contoso.com) and click <strong>Next<\/strong><\/li>\n\n\n\n<li>When prompted, enter the <strong>Temporary Access Pass<\/strong> code<\/li>\n\n\n\n<li>Windows authenticates against Entra and signs the user in to the desktop<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">No password. No MFA prompt. The user is in.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Gotchas Worth Knowing<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Entra Joined only.<\/strong> Web Sign-in + TAP doesn&#8217;t work on Hybrid Joined or domain-joined devices. On those, the user has to authenticate with a password, smart card, or FIDO2 key first, and TAP can only be used to register Windows Hello afterward.<\/li>\n\n\n\n<li><strong>Internet required.<\/strong> Web Sign-in needs an active connection. Offline sign-in falls back to cached credentials.<\/li>\n\n\n\n<li><strong>Web Sign-in becomes the default credential provider<\/strong> after it&#8217;s used, which can confuse users on subsequent sign-ins. If that&#8217;s an issue, push an Intune policy to set <strong>Password<\/strong> (or Windows Hello) as the default credential provider: <strong>Settings catalog \u2192 Administrative Templates \u2192 System \u2192 Logon \u2192 Assign a default credential provider<\/strong>.<\/li>\n\n\n\n<li><strong>Conditional Access still applies.<\/strong> If your CA policies require compliant devices or specific locations, TAP sign-in respects those rules.<\/li>\n\n\n\n<li><strong>Federated tenants:<\/strong> if FederatedIdpMfaBehavior is set to enforceMfaByFederatedIdp, the user gets redirected to the federated IdP instead of seeing a TAP prompt. Set it to acceptIfMfaDoneByFederatedIdp if you want TAP to be accepted.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Passwordless Login to Entra-Joined Devices Using a Temporary Access Pass (TAP) TL;DR Run this command on an Entra-joined Windows device (elevated Command Prompt), reboot, enable TAP in the Entra admin center, issue a passcode, and your user is one globe-icon-click away from a passwordless sign-in: reg add HKLM\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\Authentication \/v EnableWebSignIn \/t REG_DWORD \/d 1 \/f [&hellip;]<\/p>\n","protected":false},"author":8,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1938","post","type-post","status-publish","format-standard","hentry","category-uncategorized","post-preview"],"_links":{"self":[{"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/1938","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1938"}],"version-history":[{"count":1,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/1938\/revisions"}],"predecessor-version":[{"id":1939,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/1938\/revisions\/1939"}],"wp:attachment":[{"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1938"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1938"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1938"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}