# Token2 TOTP Inventory App

Find the recorded Token2 Inventory App installation route, Entra app permissions and initial sign-in details. The notes distinguish the standalone Windows app from the web app.

!!!warning Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
!!!

The **Token2 TOTP Inventory App** comes in 2 flavours.

- A Web App that can be installed on any webserver with PHP support.
- Standalone Windows app that runs its own webserver and PHP implementation. This is the simplest and preferred app, unless a dedicated webserver is required.

## Standalone Windows App

The standalone windows app is available in Intune. CCM: Token2 Inventory App has been assigned to the CCM IT Staff group and can be manually installed from the Company Portal.

The Intune app simply copies the required files to the Users Appdata\Local\Token2 Inventory App folder and creates a shortcut in the start menu to the .exe.

Alternatively you can manually download the standalone windows app from here: [TOTP Token Inventory App](https://github.com/token2/token_inventory/releases)

Or you can download from the bottom of the following link, which also has a very comprehensive run down of the various management methods. Well worth a read.

[TOTP Token Inventory: Automate Token2 Classic OATH Token Activation in Microsoft Entra ID](https://www.token2.com/site/page/totp-token-inventory-automate-token2-classic-oath-token-activation-in-microsoft-entra-id)

## EntraID App Registration

The App connects to EntraID using an App Registration called **CCM: Token2 Token Inventory App**.

It is configured with the necessary permissions which are;

- Policy.ReadWrite.AuthenticationMethod
- UserAuthenticationMethod.ReadWrite.All
- User.Read.All
- Directory.Read.All

## Initial Logon

When opening the application for the first time you will require the following.

| APP (Client) ID | a963426b-de08-4282-8a3e-0cccf3e836af |
|-----------------|--------------------------------------|
| Tenant ID       | 912e9bd6-236e-46f5-9c0c-b99867e6b99b |
| Client Secret   | College Client Secret                |

[Screenshot retained for review](../../review/Review-status.md#asset-46fd98fe5daeb9c287de)

## College Client Secret

Each College will need to create its own Client Secret in the CCM: Token2 Token Inventory App registration [CCM: Token2 Token Inventory App - Microsoft Azure](https://portal.azure.com/?feature.msaljs=true#view/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/~/Credentials/appId/a963426b-de08-4282-8a3e-0cccf3e836af)

You will require the Application Administrator role as a minimum, or GA.

Alternatively request CCM IT create a client secret for your college.

NOTE: You only need to PIM to these roles to initially create the client secret. Once the client secret is created, because it uses the App Registration permissions to manage tokens, any user who has access to the secret can then use the TOTP Token Inventory App to manage tokens WITHOUT the need to PIM.

The source recommends retaining the client secret in the college Bitwarden vault. It reports occasions when the Inventory App forgot the secret, requiring a new app-registration secret if the original value had not been retained.

## Related guidance

- [Topic overview](Introduction.md)
- [Source review status](../../review/Review-status.md)