Connect-XdrByTemporaryAccessPass
SYNOPSIS
Authenticates to Microsoft Defender XDR using a Temporary Access Pass (TAP).
SYNTAX
Connect-XdrByTemporaryAccessPass [[-Username] <String>] [[-TemporaryAccessPass] <SecureString>]
[[-TenantId] <String>] [[-UserAgent] <String>] [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Performs the Entra ID TAP web sign-in flow programmatically (no browser required), extracts the ESTSAUTH cookie, and then passes it to Connect-XdrByEstsCookie to establish an authenticated Defender XDR session.
TAP sign-in is tenant-scoped. If TenantId is omitted, the cmdlet attempts to resolve the tenant automatically from the supplied username before starting the Entra authorize flow.
EXAMPLES
EXAMPLE 1
$tap = ConvertTo-SecureString '+&YZuead' -AsPlainText -Force
Connect-XdrByTemporaryAccessPass -Username 'admin@contoso.com' -TemporaryAccessPass $tap -TenantId '8612f621-73ca-4c12-973c-0da732bc44c2'
Authenticates using the supplied TAP and connects to Defender XDR.
EXAMPLE 2
Connect-XdrByTemporaryAccessPass -TenantId '8612f621-73ca-4c12-973c-0da732bc44c2'
Prompts for username and TAP, then authenticates and connects.
EXAMPLE 3
Connect-XdrByTemporaryAccessPass -Username 'admin@contoso.com'
Prompts for the TAP, resolves the tenant automatically from the username, then authenticates and connects.
PARAMETERS
-Username
The user principal name (e.g., admin@contoso.com). If omitted, you are prompted interactively.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-TemporaryAccessPass
The Temporary Access Pass as a SecureString. If omitted, you are prompted interactively.
Type: SecureString
Parameter Sets: (All)
Aliases: TAP
Required: False
Position: 2
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-TenantId
The Entra tenant ID used for TAP authentication and the Defender XDR connection. If omitted, the cmdlet resolves the tenant from Username.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: 3
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-UserAgent
User-Agent string for HTTP requests. Defaults to a browser-compatible Edge user agent.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: 4
Default value: (Get-XdrDefaultUserAgent)
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.