EIDSCA.AT02 - Authentication Method - Temporary Access Pass - One-time.
Overview
Determines whether the pass is limited to a one-time use.
Avoid to allow reusable passes and restrict usage to one-time use (if applicable)
Test script
https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations('TemporaryAccessPass')
.isUsableOnce -eq 'true'
Remediation action
Microsoft Learn - Require one-time use (Step 5)
Related links
- Open in Graph Explorer
- temporaryAccessPassAuthenticationMethodConfiguration resource type - Microsoft Graph v1.0 | Microsoft Learn
Test Metadata
| Field | Value |
|---|---|
| Test ID | EIDSCA.AT02 |
| Severity | Medium |
| Suite | Entra ID SCA |
| Product | Entra ID |
| Feature | Authentication methods |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:IA-5 |
| PowerShell test | Test-MtCheckEidscaAT02 |
| Services | Graph |
Source
- Test:
tests/eidsca/Test.EIDSCA.AT02.ps1 - Documentation:
tests/eidsca/Test.EIDSCA.AT02.md