Use Web sign-in and a Temporary Access Pass to set up a Windows device

Draft: This article records our current setup for using Windows Web sign-in with a Microsoft Entra Temporary Access Pass (TAP). We will refine it as we use the feature on more devices.

What this is for

Web sign-in adds another sign-in option to the Windows lock screen. It allows an authorised user or technician to use a time-limited TAP during device setup without needing the user's Microsoft 365 password.

Enabling Web sign-in does not remove the existing Windows Hello PIN or password options. Staff can continue using their normal sign-in method after setup.

Requirements

Windows 11, version 22H2 or later, with current Windows updates
A Microsoft Entra joined device
Internet access at the Windows sign-in screen
Temporary Access Pass enabled for the relevant users in the Microsoft Entra authentication methods policy
An appropriate Microsoft Entra administrator role to create the TAP

Web sign-in is not supported on Microsoft Entra hybrid joined or traditional Active Directory domain joined devices.

Microsoft guidance compared with field reports

Microsoft's documentation is the source of truth for supported behaviour. A discussion in the r/Intune community also contains useful accounts from administrators who have deployed Web sign-in. Those comments are practical experience, not official guidance.

Topic	Microsoft documentation	Administrator field reports	Practical decision
TAP during setup	A TAP can be used through Web sign-in to bootstrap Windows Hello for Business or a FIDO2 security key.	Administrators described using TAP during OOBE and Autopilot so they could prepare user-affinity devices without knowing the user's password. One reported preparing 80 devices in two days after obtaining user consent.	This is the main reason to deploy the feature for managed laptops.
Normal daily sign-in	Web sign-in adds a credential provider. It does not remove PIN or password by itself.	Administrators commonly kept PIN, password or FIDO2 as the normal sign-in method and treated Web sign-in as an onboarding or recovery option.	Keep existing sign-in methods available to minimise disruption.
Offline use	Web sign-in requires internet access and does not support cached credentials.	The community discussion treats Web sign-in as an additional method rather than the only way to access a device.	Users must retain PIN or password access for offline sign-in.
Broad assignment	Microsoft allows the policy to be assigned to the required device or user group. Web sign-in can become the default credential provider for a new user.	Some administrators target a broad group with a device filter so only supported Windows Hello for Business laptops receive the policy.	Broad assignment is reasonable for a small, known group of supported Microsoft Entra joined laptops. Check the first few devices before expanding it further.
Shared-device recovery	Web sign-in supports TAP and other web-based authentication methods on supported devices.	One administrator uses it as a fallback when a shared-device user misplaces a FIDO2 key.	This is a useful secondary scenario, but it needs its own shared-device testing.
Passwordless Experience policy	This is a separate policy which can hide the password credential provider from the lock screen and from in-session authentication prompts.	Administrators warned that hiding password sign-in can interfere with UAC and legacy applications that still expect a password.	Do not enable Passwordless Experience as part of the Web sign-in rollout. Test it separately if it is considered later.

Configure Web sign-in with Microsoft Intune

Open the Microsoft Intune admin centre.
Go to Devices > Configuration and create a new Windows settings catalogue policy.
In Configuration settings, open the Authentication category.
Add Enable Web Sign In and set it to Enabled.
Leave the other Authentication settings as Not configured unless they are needed for a separate, tested requirement.
Assign the profile to the required device group.

A clear profile name is Windows - Enable Web sign-in for TAP onboarding.

Do not enable Enable Passwordless Experience as part of this change. That is a separate feature which can hide the password credential provider from the lock screen and from some in-session authentication prompts, including UAC.

Create a Temporary Access Pass

Open the Microsoft Entra admin centre.
Go to Entra ID > Users and open the user.
Select Authentication methods > Add authentication method.
Select Temporary Access Pass.
Choose a short lifetime that is long enough to complete the setup. Use a one-time pass where practical.
Create the pass and copy it immediately. Microsoft only displays the TAP value once.

Treat a TAP like a temporary password. Share it only with the person completing the authorised setup and remove it when it is no longer needed.

Use the TAP at the Windows lock screen

Make sure the computer is connected to the internet.
At the lock screen, select Sign-in options.
Select the Web sign-in credential provider.
Enter the user's Microsoft 365 email address when prompted.
Use the TAP when the Microsoft sign-in page asks for authentication.
Complete the required device setup, then configure the user's normal Windows Hello PIN when the user is available.

If Web sign-in cannot continue because the device is offline, return to the lock screen and choose PIN or password instead. If the Back button does not return to the lock screen, press Ctrl+Alt+Delete.

What to expect

Windows creates a system-managed local account called WsiAccount. This is expected and it is not shown in the normal user list.
Web sign-in may become the default credential provider for a new user signing into the device.
Web sign-in cannot use cached credentials and therefore requires internet access.
The normal PIN and password sign-in options remain available unless a different policy explicitly hides them.

Troubleshooting

The Web sign-in option is missing

Confirm that the device is Microsoft Entra joined, not merely registered or hybrid joined.
Confirm that it is running a supported and fully updated version of Windows 11.
Check that the Intune configuration profile has applied successfully.
Run a device sync from Intune or from the device's work or school account settings.

The TAP is not accepted

Confirm that Temporary Access Pass is enabled in the tenant's Authentication methods policy.
Confirm that the user is included in that policy.
Check that the TAP has not expired or already been used.
Create a new short-lived TAP if the original pass is no longer valid.