In this article, we will describe how to set up both types of hardware tokens for Azure token-based authentication. All three devices can be bought here<\/a>.<\/p>\n\n\n\n <\/p>\n\n\n\n Currently, Azure AD supports tokens with passwords not longer than 128 characters and password life-span of 30 and 60 seconds. Protectimus Two<\/a> hardware OTP tokens fit these requirements.<\/p>\n\n\n\n Once you choose and receive the Azure MFA OATH token you prefer you need to register your token with Azure. Below is the step-by-step guide on this simple process:<\/p>\n\n\n\n Step 1<\/strong>. Prepare a CSV file that includes your UPN (user principal name<\/a>), the serial number of the hardware token Azure MFA, the seed (secret key), time interval, make and model of the Azure AD MFA hardware token. Make sure to include a header row, the result should look something like this: <\/p>\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n Step 2<\/strong>. Once the CSV file is created and properly formatted it has to be imported. Go to Azure Portal<\/a> and browse to Azure Active Directory, then to Security and to Multi-Factor Authentication. On the MFA page choose OATH tokens<\/a> and click the \u201cUpload\u201d button. Upload your CSV file; the upload process might take a few minutes. <\/p>\n\n\n\n <\/p>\n\n\n\n Step 3<\/strong>. Click the \u201cRefresh\u201d button. If the CSV file was uploaded successfully you will see a list of your Azure AD hardware tokens, if the file had an error you will be notified on the same page: File uploaded successfully: <\/p>\n\n\n\n <\/p>\n\n\n\n File uploaded with errors:<\/p>\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n Step 4.<\/strong> Now you need to activate your Azure multi-factor authentication hardware token. If you have multiple tokens, you should activate them one by one. Click the \u201cActivate\u201d button at the lattermost column on the right and enter the password generated by the corresponding Azure MFA token. After that, click the \u201cVerify\u201d button.<\/p>\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n Step 5. <\/strong>Once the MFA server accepts your one-time password you will get a message confirming the activation of the Microsoft Azure token you selected from the list and there should appear a check mark in the corresponding \u201cActivated\u201d column. Now your token is successfully activated and can be used to log in.<\/p>\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n Step 6.<\/strong> 2FA settings in the user account.<\/p>\n\n\n\n OATH tokens will be automatically set as a main 2FA method. <\/p>\n\n\n\n NOTE!<\/strong> If any other 2-factor authentication method is registered for a user, they can use several two-factor authentication methods at once. For example, I activated a 2FA app Protectimus SMART as a 2FA methos, in this case, both one-time passwords from hardware token and 2FA app will work when I enter any of them in this field:<\/p>\n\n\n If you want to use only a hardware OATH token for Azure 2-factor authentication, login to your account and deactivate other two-factor authentication methods.<\/p>\n\n\n\n <\/p>\n\n\n\n<\/p>\n \n\n\n\n<\/p>\n As has already been mentioned above – to use a classic Microsoft Azure MFA hardware token you need to have a premium subscription. But we know that not everyone is ready to pay 6 euros per month per one user. If you are not ready to pay too, programmable hardware tokens Protectimus Slim NFC<\/a> or Protectimus Flex<\/a> is the way to go for you. These tokens are recognized as authentication apps by the Azure MFA system, so you do not need a premium license to use them.<\/p>\n \n\n\n\n<\/p>\n Adding Protectimus Slim NFC or Protectimus Flex as a recognized second factor of authentication to your Azure MFA is pretty straightforward. All you need to do is log into the MFA setup page<\/a>, configure the authentication to recognize your Azure authentication token and program the device itself to be used for Azure MFA. The whole process takes mere minutes and is described in detail here<\/a>.<\/p>\n \n\n\n\n<\/p>\n \n\n\n\n <\/p>\n <\/p>\n Microsoft does not provide any exact info on time drift with Azure MFA, but the implementation has been said to be based on RFC 6238 which suggests that the time drift is indeed supported. Azure MFA allows one-time passwords within a time range of 900 seconds, this means time drift support is not really necessary. But if you’d like to keep time drift issue under control, use Protectimus Slim NFC or Protectimus Flex tokens, which have a time synchronization feature now. The time is resynchronized when a secret key is flashed to the token.<\/p>\n <\/p>\n<\/div>\n <\/p>\n A hardware token is by far the most bulletproof protection you can get for your data stored on a cloud. Such a device generates secure passwords without and needs no network connection whatsoever. With a hardware token you have an impenetrable wall between your data and anyone who tries to steal it. There\u2019s simply no way for hackers to infect the device or intercept the generated codes. And if a hardware token is stolen or lost you most probably will notice it immediately, whereas with an infected app or intercepted SMS you might not know any damage is done before it\u2019s too late.<\/p>\n <\/p>\n<\/div>\n <\/p>\n If you want Protectimus Slim NFC you can have the device branded even if your order is as small as one token. With Protectimus TWO custom branding is offered for orders over 1000 devices.<\/p>\n <\/p>\n<\/div>\n <\/p>\n No, this token allows for one seed at a time. But Protectimus Slim NFC can be programmed to work for a different resource once you stop using the one you initially programmed it for.<\/p>\n <\/p>\n<\/div>\n<\/div>\n \n\n\n<\/p>\n\n\n<\/p>\n \n\n\n\n<\/p>\n \n<\/span>","protected":false},"excerpt":{"rendered":" There are currently two ways to implement an Azure hardware token for Azure Multi-Factor Authentication: In this article, we will describe how to set up both types of hardware tokens for Azure token-based authentication. All three devices can be bought here. Classic OATH hardware tokens for Azure MFA – how to set up Currently, Azure […]<\/p>\n","protected":false},"author":6,"featured_media":4238,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[9,329],"tags":[1048,1302,335,1286,421,139],"class_list":["post-3886","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-protectimus-products","category-setup-guides","tag-azure-mfa-en","tag-protectimus-crystal-en","tag-protectimus-slim-nfc-en","tag-protectimus-two-en","tag-setup-guides","tag-tokens"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/posts\/3886","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/comments?post=3886"}],"version-history":[{"count":38,"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/posts\/3886\/revisions"}],"predecessor-version":[{"id":9118,"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/posts\/3886\/revisions\/9118"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/media\/4238"}],"wp:attachment":[{"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/media?parent=3886"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/categories?post=3886"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/tags?post=3886"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Classic OATH hardware tokens for Azure MFA – how to set up<\/strong><\/h2>\n\n\n\n
![\"How](\"https:\/\/www.protectimus.com\/blog\/wp-content\/uploads\/2019\/03\/csv-file-for-oath-tokens-in-azure-mfa.png\")
<\/figure>\n<\/div>\n\n\n
<\/p>\n\n\n![\"Azure](\"https:\/\/www.protectimus.com\/blog\/wp-content\/uploads\/2019\/03\/Azure-MFA-hardware-token-setup-step2-2.png\")
<\/figure>\n<\/div>\n\n\n
<\/p>\n\n\n\n
<\/p>\n\n\n![\"Azure](\"https:\/\/www.protectimus.com\/blog\/wp-content\/uploads\/2019\/03\/Azure-MFA-OATH-token-setup-step3-1-1.png\")
<\/figure>\n<\/div>\n\n\n![\"Azure](\"https:\/\/www.protectimus.com\/blog\/wp-content\/uploads\/2019\/03\/Azure-MFA-OATH-token-setup-step3-2.png\")
<\/figure>\n<\/div>\n\n\n![\"Azure](\"https:\/\/www.protectimus.com\/blog\/wp-content\/uploads\/2019\/03\/Azure-multi-factor-authentication-activate-OATH-token-step4-1.png\")
<\/figure>\n<\/div>\n\n\n![\"OATH](\"https:\/\/www.protectimus.com\/blog\/wp-content\/uploads\/2019\/03\/OATH-hardware-tokens-Azure-MFA-setup-step5-1.png\")
<\/figure>\n<\/div>\n\n\n![\"Azure](\"https:\/\/www.protectimus.com\/blog\/wp-content\/uploads\/2022\/08\/oath-tokens-to-azure-mfa-step-7.png\")
<\/a><\/figure><\/div>\n\n\n\n
![\"Azure](\"https:\/\/www.protectimus.com\/blog\/wp-content\/uploads\/2022\/08\/oath-tokens-to-azure-mfa-step-8-1024x354.png\")
<\/a><\/figure><\/div>\n\n\nProgrammable hardware tokens for Azure MFA <\/strong><\/h2>\n
Common questions<\/strong><\/h2>\n
Read more:<\/strong><\/h2>\n
\n