Temporary Access Pass Login
Detects successful authentications where a Temporary Access Pass (TAP) was used as the primary authentication method. TAPs bypass standard password and MFA requirements, and their usage outside of expected scenarios (like onboarding or account recovery) could indicate an adversary bypassing authentication mechanisms.
Microsoft Sentinel (KQL)
