EIDSCA.AT02: Authentication Method - Temporary Access Pass - One-time.
| ID | EIDSCA.AT02 |
| Severity | Medium |
| Suite | EIDSCA |
| Product | Entra ID |
| Feature | Authentication methods |
| Security area | Authentication |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:IA-5 Authenticator Management |
| MITRE ATT&CK | T1078.004 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Determines whether the pass is limited to a one-time use.
Avoid to allow reusable passes and restrict usage to one-time use (if applicable)
Test script
Section titled “Test script”https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations('TemporaryAccessPass').isUsableOnce -eq 'true'Remediation action
Section titled “Remediation action”Microsoft Learn - Require one-time use (Step 5)
Related links
Section titled “Related links”- Open in Graph Explorer
- temporaryAccessPassAuthenticationMethodConfiguration resource type - Microsoft Graph v1.0 | Microsoft Learn
Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.