starred/CIPP

Fork 0

mirror of https://github.com/KelvinTegelaar/CIPP.git synced 2026-04-25 16:26:09 +03:00

[GH-ISSUE #2564] [Feature Request]: Ability to add an exclusion group for TAP passcodes #1296

New issue

Closed

opened 2026-03-02 13:43:04 +03:00 by kerem · 2 comments

kerem commented

2026-03-02 13:43:04 +03:00

Owner

Originally created by @SGeeves on GitHub (Jun 18, 2024).
Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/2564

Since temporary access passcodes are becoming and extremely useful thing. When enabling the temporary access passcodes, this by default is enabling this for all users, which includes Global Administrators. As an MSP, we like to be able to use the audit log to see who did what when if needed, however the TAP policy enables the creation of the passcode on these admin accounts and then they can sign in as a global admin... defeating the object, and then not being able to easily track.

We have a group created where these high level admin role accounts sit currently so they can be excluded, but currently this is a manual process to head into the Temporary Access Pass settings, and add in an Exclusion on each tenant.

It would be great if there was an ability to add this exclusion within CIPP when being pushed out as a standard.

I am a sponsor under: FutureITNZ

PowerShell commands you would normally use to achieve above request

No response

Originally created by @SGeeves on GitHub (Jun 18, 2024). Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/2564 Since temporary access passcodes are becoming and extremely useful thing. When enabling the temporary access passcodes, this by default is enabling this for all users, which includes Global Administrators. As an MSP, we like to be able to use the audit log to see who did what when if needed, however the TAP policy enables the creation of the passcode on these admin accounts and then they can sign in as a global admin... defeating the object, and then not being able to easily track. We have a group created where these high level admin role accounts sit currently so they can be excluded, but currently this is a manual process to head into the Temporary Access Pass settings, and add in an Exclusion on each tenant. It would be great if there was an ability to add this exclusion within CIPP when being pushed out as a standard. I am a sponsor under: FutureITNZ ### PowerShell commands you would normally use to achieve above request _No response_

kerem

2026-03-02 13:43:04 +03:00

closed this issue
added the
enhancement

no-priority
labels

kerem commented

2026-03-02 13:43:05 +03:00

Author

Owner

@KelvinTegelaar commented on GitHub (Jun 20, 2024):

I think its a better plan to track when this happens and attack the problem, not a symptom:

Disable access to your current GAs for your team
Setup a CIPP alert for changes admin passwords
Setup a CIPP alert for created TAP for admins
use CIPPs JIT access instead.

Policy seems more sensible here than the feature, so for now, no :)

@KelvinTegelaar commented on GitHub (Jun 20, 2024): I think its a better plan to track when this happens and attack the problem, not a symptom: - Disable access to your current GAs for your team - Setup a CIPP alert for changes admin passwords - Setup a CIPP alert for created TAP for admins - use CIPPs JIT access instead. Policy seems more sensible here than the feature, so for now, no :)

kerem commented

2026-03-02 13:43:05 +03:00

Author

Owner

@SGeeves commented on GitHub (Jun 20, 2024):

Appreciate the comment @KelvinTegelaar , no worries, fully understand your perspective.
We have already set an exclusion group manually, which CIPP doesn't overwrite as long as TAP is enabled. So we'll stick with that for now then :)
Our stance is to stop it happening rather than re-actively action.

Keep up the good work though, loving CIPP and the responsiveness on features and bugs!

@SGeeves commented on GitHub (Jun 20, 2024): Appreciate the comment @KelvinTegelaar , no worries, fully understand your perspective. We have already set an exclusion group manually, which CIPP doesn't overwrite as long as TAP is enabled. So we'll stick with that for now then :) Our stance is to stop it happening rather than re-actively action. Keep up the good work though, loving CIPP and the responsiveness on features and bugs!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/CIPP#1296

No description provided.

Rows
Columns