📋 Microsoft Entra Documentation Changes

|---------|---------|

|category | A read-only string that identifies the category or categories of the task. Automatically determined when the taskDefinitionID is chosen. |

|taskDefinitionId | A string referencing a taskDefinition that determines which task to run. |

|displayName | A unique string that identifies the task. |

|description | A string that describes the purpose of the task for administrative use. (Optional) |

|executionSequence | A read-only integer that states in what order the task runs in a workflow. |

Microsoft Entra allows you to use a [Temporary Access Pass (TAP)](..//identity/authentication/howto-authentication-temporary-access-pass.md) to set up password-less credentials for users. You can also use [Microsoft Entra self-service password reset](../identity/authentication/concept-sspr-howitworks.md) to set a regular password. With this task, Lifecycle workflows allow you to automatically generate a Temporary Access Pass (TAP), and have it sent to the new user's manager. You're also able to customize the email that is sent to the user's manager.

 

> [!NOTE]

 

With this task in the Microsoft Entra admin center, you're able to give the task a name and description. You must also set:

 

|displayName | GenerateTAPAndSendEmail (Customizable by user) |

|description | Generate Temporary Access Pass and send via email to user's manager (Customizable by user) |

|taskDefinitionId | 1b555e50-7f65-41d5-b514-5894a026d10d |

 

Example of usage within the workflow:

---

title: Include file

description: Include file

ms.service: entra-id

ms.custom: include file, sfi-image-nochange

---

 

 

:::image type="content" source="media/entra-cloud-sync-how-to-install/finish.png" alt-text="Screenshot that shows the finish screen." lightbox="media/entra-cloud-sync-how-to-install/finish.png":::

 

- Message body

- Email language

 

 

For more information on these customizable parameters, see [Common email task parameters](lifecycle-workflow-tasks.md#common-email-task-parameters).

 

 

1. Enter a custom subject, a message body, and the email language translation option that will be used to translate the message body of the email.

 

 

:::image type="content" source="media/customize-workflow-email/customize-workflow-email-example.png" alt-text="Screenshot of an example of a customized email from a workflow.":::

 

Emails sent by workflows can have their text customized to personalize, or stress specific points within, them. Workflow text can currently be customized in the following ways:

 

- **Bold**: Text within emails can be bolded by placing the desired text within `<b></b>` brackets.

- **Links**: Hyperlinks can be added to text by placing the desired link within `<a href=> </a>` brackets.

 

- *Show the top 5 users with the highest data consumption in the last day.*

- *Show all blocked traffic for user {user principal name} in the last 24 hours.*

 

## See also

 

eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Imk2bEdrM0ZaenhSY1ViMkMzbkVRN3N5SEpsWSJ9.eyJhdWQiOiI2ZTc0MTcyYi1iZTU2LTQ4NDMtOWZmNC1lNjZhMzliYjEyZTMiLCJpc3MiOiJodHRwczovL2xvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20vNzJmOTg4YmYtODZmMS00MWFmLTkxYWItMmQ3Y2QwMTFkYjQ3L3YyLjAiLCJpYXQiOjE1MzcyMzEwNDgsIm5iZiI6MTUzNzIzMTA0OCwiZXhwIjoxNTM3MjM0OTQ4LCJhaW8iOiJBWFFBaS84SUFBQUF0QWFaTG8zQ2hNaWY2S09udHRSQjdlQnE0L0RjY1F6amNKR3hQWXkvQzNqRGFOR3hYZDZ3TklJVkdSZ2hOUm53SjFsT2NBbk5aY2p2a295ckZ4Q3R0djMzMTQwUmlvT0ZKNGJDQ0dWdW9DYWcxdU9UVDIyMjIyZ0h3TFBZUS91Zjc5UVgrMEtJaWpkcm1wNjlSY3R6bVE9PSIsImF6cCI6IjZlNzQxNzJiLWJlNTYtNDg0My05ZmY0LWU2NmEzOWJiMTJlMyIsImF6cGFjciI6IjAiLCJuYW1lIjoiQWJlIExpbmNvbG4iLCJvaWQiOiI2OTAyMjJiZS1mZjFhLTRkNTYtYWJkMS03ZTRmN2QzOGU0NzQiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJhYmVsaUBtaWNyb3NvZnQuY29tIiwicmgiOiJJIiwic2NwIjoiYWNjZXNzX2FzX3VzZXIiLCJzdWIiOiJIS1pwZmFIeVdhZGVPb3VZbGl0anJJLUtmZlRtMjIyWDVyclYzeERxZktRIiwidGlkIjoiNzJmOTg4YmYtODZmMS00MWFmLTkxYWItMmQ3Y2QwMTFkYjQ3IiwidXRpIjoiZnFpQnFYTFBqMGVRYTgyUy1JWUZBQSIsInZlciI6IjIuMCJ9.pj4N-w_3Us9DrBLfpCt

```

 

 

## Token ownership

 

An access token request involves two parties: the client, who requests the token, and the resource (Web API) that accepts the token. The resource that the token is intended for (its *audience*) is defined in the `aud` claim in a token. Clients use the token but shouldn't understand or attempt to parse it. Resources accept the token.

 

 

Resources always own their tokens using the `aud` claim and are the only applications that can change their token details.

 

 

You can create a group that contains all direct reports of a manager. When the manager's direct reports change in the future, the group's membership is adjusted automatically.

 

You construct the direct reports rule by using the following syntax:

 

```

 

For hybrid-joined devices, users must first authenticate with another method such as a password, smartcard or FIDO2 key, before using TAP to set up Windows Hello for Business.

> [!NOTE]

 

:::image type="content" border="true" source="./media/how-to-authentication-temporary-access-pass/windows-10-tap.png" alt-text="Screenshot of how to enter Temporary Access Pass when setting up Windows.":::

 

 

1. User requests a DNS query for `app.contoso.com`. If not cached locally, the DNS query is sent to the DNS proxy at the GSA edge.

1. DNS proxy either responds from its cache or forwards the query to the Connector Group defined in Quick Access.

1. DNS proxy responds back to the client with the internal IP. The client stores the internal IP address and returns a synthetic IP to the application.

 

 

- Policy details are provided as both a list of all the details that are changing and a JSON view of the entire policy, with the changes highlighted.

- For policy changes that affect users or applications, you can download a JSON file of the users and applications affected by the policy change.

 

 

Deep analysis performs an in-depth review of Conditional Access policies for scenarios such as blocking legacy authentication, blocking device control flow, and policies that require device or MFA controls. It evaluates the targeted users, groups, and roles to identify coverage gaps, overlapping or redundant policies, and consolidation opportunities. It also analyzes exclusions—flagging policies that exclude a large portion of users and recommending explicit exclusion of break‑glass accounts to reduce the risk of accidental lockout.

 

The **Pre-Offboard inactive users** template is designed to configure tasks that must be completed before offboarding inactive users.

 

 

 

The default specific parameters for the **Pre-Offboard inactive users** template are as follows:

 

## Next step

 

- [Manage workflow versions](manage-workflow-tasks.md)