Autmatic set OATH hardware token serials for Azure AD Accounts

Question

Autmatic set OATH hardware token serials for Azure AD Accounts

Stefan Horz 3,466

Hello,

it is described at https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-oath-tokens#oath-hardware-tokens-preview how to assign the serial of an OATH hardware token to an UPN uploading a csv file.
Can this step be automated in an Onboarding process for a new User.

Regards,
Stefan

JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2022-03-16T21:02:36.207+00:00

@Stefan Horz
I received an update from our engineering team, and if you don't have any limitations when it comes to end users registering their own OATH tokens, you can try leveraging FIDO2 security keys.

If you have any other questions, please let me know.
Thank you for your time and patience!
Deepnet Security 0 Reputation points

2025-04-09T15:56:58.16+00:00

The instructions for creation and uploading of the CSV file can be found here;

https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-upload-oath-tokens

There is however still an error in the example CSV file they provide (the example used to use a hex encoding and mis-described the valid characters for Base32 encoding).

The description of Base32 encoding is now correct on this page, but the example is still poor as visually it still resembles Hex encoding (it would actually still count as valid Hex encoding).

Accepted answer

0 additional answers

Your answer

JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2022-03-16T21:02:36.207+00:00

@Stefan Horz
I received an update from our engineering team, and if you don't have any limitations when it comes to end users registering their own OATH tokens, you can try leveraging FIDO2 security keys.

If you have any other questions, please let me know.
Thank you for your time and patience!
Deepnet Security 0 Reputation points

2025-04-09T15:56:58.16+00:00

The instructions for creation and uploading of the CSV file can be found here;

https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-upload-oath-tokens

There is however still an error in the example CSV file they provide (the example used to use a hex encoding and mis-described the valid characters for Base32 encoding).

The description of Base32 encoding is now correct on this page, but the example is still poor as visually it still resembles Hex encoding (it would actually still count as valid Hex encoding).

Answer 1

JamesTran-MSFT 36,911 Microsoft Employee Moderator

@Stefan Horz
Thank you for your post and I apologize for the delayed response!

From our documentation it doesn't seem like there's a supported way of automating this process through PS, Graph, or REST API. However, I found a 3rd party PowerShell script that might help point you in the right direction.

Links:
Automate Azure MFA Hardware Tokens
Automating Upload and Activation of Hardware Tokens for Azure MFA
Azure AD authentication methods API overview

If you'd like automation of OAuth tokens to be a feature of Azure AD MFA, I'd recommend leveraging our User Voice forum and creating a feature request, so our engineering team can look into implementing this. I've also created an internal feature request, so our engineering team is aware of this as well.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2022-03-01T18:25:46.987+00:00

@Stefan Horz
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?
Stefan Horz 3,466 Reputation points

2022-03-01T19:45:14.07+00:00

@JamesTran-MSFT , thank you for your answer.
Sorry, I missed your first reply (comment).

This will answer my question. I will try soon.
I guess because it's a comment I can't mark the reply as answered.

Again thank, you so much,
Stefan
Andreas Baumgarten 123.6K Reputation points MVP Volunteer Moderator

2022-03-02T18:47:21.747+00:00

Hi @Stefan Horz ,

No worries. I converted the comment to an answer ;-)
Feel free to mark as an answer now.

----------

Kind regards
Andreas Baumgarten
Deepnet Security 0 Reputation points

2024-06-07T10:59:26.1966667+00:00

If you'd like automation of OAuth tokens

Just a minor correction, the tokens are "Oath" hardware tokens and not "oAuth" tokens.

Oath TOTP tokens are physical tokens (and when used with Microsoft should be TOTP and not HOTP tokens - example Microsoft compatible hardware tokens ).

Oauth tokens are data based access tokens in the forms of stored data, ad differs from physical hardware tokens.

Share via

Autmatic set OATH hardware token serials for Azure AD Accounts

0 additional answers

Your answer