Azure Temporary Access Pass (TAP) registered to an account

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2026-02-09

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: AzureAD Audit Log
Detection Modules	Identity Threat Module
Detector Tags
ATT&CK Tactic	Defense Evasion (TA0005) Privilege Escalation (TA0004)
ATT&CK Technique	Valid Accounts (T1078)
Severity	Informational
Response playbooks	Variations of this detector that create incidents have an OOTB response playbook included in the Cortex Response and Remediation Pack

An identity registered an Azure Temporary Access Pass (TAP) to an account.

A TAP can allow setting of other authentication methods and can be used as an initial replacement of a multifactor authentication.

Check if the account that got the TAP should get it.
Check whether the account that registered the TAP is supposed to perform such actions.
Check if the TAP was registered to a privileged account.
Follow further actions done by the initiator and the account with the TAP.

ATT&CK Tactic

ATT&CK Technique

Severity

Medium

An identity registered an Azure Temporary Access Pass (TAP) to an account.

A TAP can allow setting of other authentication methods and can be used as an initial replacement of a multifactor authentication.

Check if the account that got the TAP should get it.
Check whether the account that registered the TAP is supposed to perform such actions.
Check if the TAP was registered to a privileged account.
Follow further actions done by the initiator and the account with the TAP.

ATT&CK Tactic	Defense Evasion (TA0005) Privilege Escalation (TA0004)
ATT&CK Technique	Valid Accounts (T1078)
Severity	Low
Response playbooks	Azure Temporary Access Pass (TAP) registered to an account

An identity registered an Azure Temporary Access Pass (TAP) to an account.

A TAP can allow setting of other authentication methods and can be used as an initial replacement of a multifactor authentication.

Check if the account that got the TAP should get it.
Check whether the account that registered the TAP is supposed to perform such actions.
Check if the TAP was registered to a privileged account.
Follow further actions done by the initiator and the account with the TAP.