Question Regarding Hardware OATH Tokens and User Authentication Method Visibility

Question

Hi,

I have a question about Hardware OATH tokens, user authentication methods, and “My Security Info” within myaccount.microsoft.com.

We’ve recently issued users Hardware OATH tokens, uploaded a CSV containing serial numbers, model, manufacturer, secret keys, etc. to the Multifactor authentication | OATH tokens (Preview) section in Azure, and successfully activated them.

We’ve noticed that these Hardware OATH tokens appear under the user’s security information in myaccount.microsoft.com, and the user is able to delete them. Is this standard and expected behavior? Is there a way to prevent users from being able to remove their Hardware OATH tokens?

Additionally, we’ve noticed that these tokens do not appear under the User Authentication Methods section within Azure, whereas other methods (such as TAP, email, phone, SMS, Authenticator app, Windows Hello for Business, etc.) do. Is this expected, and is there a specific reason why Hardware OATH tokens do not appear under this view?

Happy to provide screenshots if that would be helpful.

Thanks,

Chris