IT Services Reference
Powered by

Hardware token management options

In 

Compare manual CSV import, Graph API management and the Token2 Inventory App for hardware tokens. The notes describe trade-offs and the initial implementation choice.

There are 3 methods for managing tokens.

  • Manual import and management of tokens in a CSV file, via the Security > Multifactor authentication > OATH tokens (Preview) blade in EntraID.
  • Import and management using Graph API.
  • Using Token2 TOTP Token Inventory App.
  1. Manual Import.
  2. Importing and assigning of tokens is done via a .csv file that must contain the following columns. upn, serial number, secret key, timeinterval, manufacturer, model
  3. To unassign a token, it needs to be deleted from the OATH Tokens Preview blade, and a new CSV uploaded with the required details, specifically the upn of the new user to assign the token.
  4. Doesn't support SHA-256 tokens, so only option 2 and 3 are suitable for those. (The recommended tokens are SHA-1 tokens, so not an issue).
  5. The most manual process.
  6. Using Graph API.
  7. Requires scripting in PowerShell (or Python if you're interested).
  8. Uses JSON rather than CSV.
  9. Can upload, assign, activate and delete tokens programmatically.
  10. Allows for Self-Service Activation.
  11. The source suggests this approach for a future deployment of hundreds of tokens.
  12. Token2 TOTP Token Inventory App.
  13. This is an app written by Token2. It can run on a web server and requires PHP...or you can use the standalone Windows app.
  14. Being a GUI it requires less technical knowledge.
  15. It simplifies the upload, activation, assignment and deletion of tokens
  16. Supports self-service activation of tokens.
  17. It uses the Graph API underneath
  18. It requires an EntraID App registration with a client secret and uses Application permissions rather than user or delegate permissions.

The source recommends the Token2 Inventory App for the initial implementation, with Graph API automation as a possible later approach for larger deployments. Related topic pages describe the captured app setup and use.