Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.

2.1.3. Certificate-Based Authentication, Temporary Access Pass, and OAuth Tokens

💡 First Principle: Some proof arrives from outside Entra's own registration loop: certificates minted by your PKI, one-time passes minted by your admins, and software tokens minted by apps. Each binds trust from another system into Entra sign-in — and each has a narrow intended purpose the exam checks you respect.

Certificate-based authentication (CBA) lets users sign in with an X.509 certificate (smart card lineage) directly against Entra ID. You upload the issuing CA's certificates (the trust store), configure username binding (which certificate field — commonly UPN in SAN — maps to which user attribute), and set authentication binding rules that decide whether a given certificate counts as single-factor or multifactor (e.g., by issuer or policy OID). CBA is phishing-resistant and is the standard answer for federal/regulated smart-card requirements without AD FS.

Temporary Access Pass (TAP) is a time-limited passcode an admin issues so a user can authenticate without any registered method — the bootstrap and recovery tool. Two golden scenarios: onboarding a new user straight into passwordless (sign in with TAP → register passkey/Authenticator), and recovering a user who lost their phone/key. TAPs are configured in the authentication methods policy (lifetime bounds, one-time vs reusable) and satisfy MFA during their validity. They are deliberately not a long-term method.

OAuth 2.0 software tokens — time-based one-time codes (TOTP) from Authenticator or third-party apps — round out the ladder: a "something you have" code generator, stronger than SMS (no telecom channel) but not phishing-resistant, since a fake page can relay the code.

⚠️ Exam Trap: A TAP question that hints at ongoing use is a trap — the correct framing is bootstrap/recovery. Conversely, when a user "lost their only registered method and must register a new one securely," TAP is the intended answer, not "reset their password."

Reflection Question: Why does CBA need explicit authentication binding rules (single- vs multifactor) when a passkey needs no such mapping?

See how it connects
Alvin Varughese
Written byAlvin Varughese
Founder18 professional certifications