IT Services Reference
Powered by

Why Tokens?

In 

Understand the hardware-token option described for staff who cannot use a personal phone for MFA. The background includes historical policy context, not current legal or purchasing advice.

All state governments are in the process of reviewing Early Childhood Education and Care centres, with a view to implementing bans on personal mobile devices. Some jurisdictions have already implemented the new legislation, such as South Australia.

The banning of personal mobile devices, specifically mobile phones, presents an issue as all staff use their personal mobile phones for Multi Factor Authentication.

Hardware tokens are simply another mechanism that can be provided to staff, who are no longer able to use their personal mobile phones, to meet the MFA requirement.

While this is specifically targeted at ECEC staff, to meet the upcoming requirements, tokens can also be used in the event a teacher loses or forgets their mobile phone.

What Are Tokens

Hardware Tokens are devices that provide a Time-based One-Time Passcode (TOTP) that can be entered as the multi factor authentication code to any Microsoft logon MFA prompt. It achieves the same purpose as the code supplied by the Microsoft Authenticator app, or an SMS code, except that the code comes from the token device.

Hardware Tokens come in 2 different flavours:

  • Pre-Programmed. These tokens come with a random, factory-programmed "Secret" hash.
  • If the hash is stolen or leaked, the token must be disposed and removed from EntraID.
  • If the hardware token is stolen it must be removed from EntraID.
  • Programmable. These tokens also come with a random, factory-programmed "Secret" hash, however they can be reprogrammed with your own secret.
  • If the hash is stolen or leaked, the token can be reprogrammed with a new secret.

NOTE: The pre-programmed secrets have to be communicated by the manufacturer to you, as this is required for the csv upload to EntraID. As such the communicating of these secrets AND the storage of these secrets needs to be secured. Token2 offers a couple of methods to achieve this, and the source suggests Bitwarden for retaining these secrets once received.