Token2 TOTP Inventory App
Find the recorded Token2 Inventory App installation route, Entra app permissions and initial sign-in details. The notes distinguish the standalone Windows app from the web app.
Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
The Token2 TOTP Inventory App comes in 2 flavours.
- A Web App that can be installed on any webserver with PHP support.
- Standalone Windows app that runs its own webserver and PHP implementation. This is the simplest and preferred app, unless a dedicated webserver is required.
Standalone Windows App
The standalone windows app is available in Intune. CCM: Token2 Inventory App has been assigned to the CCM IT Staff group and can be manually installed from the Company Portal.
The Intune app simply copies the required files to the Users Appdata\Local\Token2 Inventory App folder and creates a shortcut in the start menu to the .exe.
Alternatively you can manually download the standalone windows app from here: TOTP Token Inventory App
Or you can download from the bottom of the following link, which also has a very comprehensive run down of the various management methods. Well worth a read.
TOTP Token Inventory: Automate Token2 Classic OATH Token Activation in Microsoft Entra ID
EntraID App Registration
The App connects to EntraID using an App Registration called CCM: Token2 Token Inventory App.
It is configured with the necessary permissions which are;
- Policy.ReadWrite.AuthenticationMethod
- UserAuthenticationMethod.ReadWrite.All
- User.Read.All
- Directory.Read.All
Initial Logon
When opening the application for the first time you will require the following.
Screenshot retained for review
College Client Secret
Each College will need to create its own Client Secret in the CCM: Token2 Token Inventory App registration CCM: Token2 Token Inventory App - Microsoft Azure
You will require the Application Administrator role as a minimum, or GA.
Alternatively request CCM IT create a client secret for your college.
NOTE: You only need to PIM to these roles to initially create the client secret. Once the client secret is created, because it uses the App Registration permissions to manage tokens, any user who has access to the secret can then use the TOTP Token Inventory App to manage tokens WITHOUT the need to PIM.
The source recommends retaining the client secret in the college Bitwarden vault. It reports occasions when the Inventory App forgot the secret, requiring a new app-registration secret if the original value had not been retained.