Detects creation of an Azure AD Temporary Access Pass (TAP) by monitoring Azure Active Directory AuditLogs for the operation "Create Temporary Access Pass method for user" with a successful result. The rule normalizes fields (actor, targetUser, user_agent), derives the initiator (actor) and the target user, and aggregates time windows (firstTime/lastTime) by destination/source and user agent. It surfaces an alert with contextual data and includes a drilldown for viewing results and related risk events. The rule maps to MITRE techniques T1556.006 (Temporary Access Pass), T1078.004 (Valid Accounts), and T1586.003 (Create Account), indicating potential persistence or account takeover if the TAP is created by an unfamiliar actor or outside normal business hours. It also highlights known false positives such as legitimate helpdesk or onboarding activity and recommends correlation with actor identity and time of creation to distinguish malicious use. References and testing guidance emphasize use with Splunk Add-on for Microsoft Cloud Services and Azure AD AuditLogs ingestion. The detection is categorized under cloud/identity security and targets Azure AD governance and access management scenarios.