What are people using for MFA tokens/hardware

[snagrat]

Looking to purchase some tokens to use with MFA to use instead of mobile phones.

 

To be used with 365.

 

Can anyone recommend a solution for this?

[mrbios]

I use some OATH tokens from here for students that don't own mobile phones and can't do MS Authenticator:

https://deepnetsecurity.com/

[3s-gtech]

I’ve used Feitian C200 tokens. Not cheap when you have a lot to buy, but they work.

[snagrat]

I use some OATH tokens from here for students that don't own mobile phones and can't do MS Authenticator:

https://deepnetsecurity.com/

 

I assume these can be re-allocated should a student leave?

 

Which model do you use. The SafeID/Classic seems a good option

[mrbios]

I assume these can be re-allocated should a student leave?

 

Which model do you use. The SafeID/Classic seems a good option

 

The SafeID/Enterprise are the ones we have at the moment, but i think the Enterprise and Classic are exactly the same beside the physical design. So long as you get the token back when a user leaves, it can be easily deleted and re-assigned.

 

When the pre-programmed tokens arrive, then you have to go to seed file request site to get the seeds for them all which are listed by serial number. You can then assign in bulk or one by one by importing CSVs to the Entra portals Hardware OATH page... they have to be activated too, so far i've only assigned 5 of them, so i've activated them for the user. I assume if handed out unactivated, that the user has to activate it on first use....at least i hope that's the case, might test that later if i get time.

[snagrat]

The SafeID/Enterprise are the ones we have at the moment, but i think the Enterprise and Classic are exactly the same beside the physical design. So long as you get the token back when a user leaves, it can be easily deleted and re-assigned.

 

When the pre-programmed tokens arrive, then you have to go to seed file request site to get the seeds for them all which are listed by serial number. You can then assign in bulk or one by one by importing CSVs to the Entra portals Hardware OATH page... they have to be activated too, so far i've only assigned 5 of them, so i've activated them for the user. I assume if handed out unactivated, that the user has to activate it on first use....at least i hope that's the case, might test that later if i get time.

 

Might be looking at around 1400 of them so might be worth buying a few first to see how they work

[dhicks]

Looking to purchase some tokens to use with MFA to use instead of mobile phones.

 

We have the Feitian K9 rolled out to all staff (around 100):

 

https://www.ftsafe.com/products/FIDO/NFC

 

They use both USB and NFC, we've had staff using them as 2FA keys for a couple of years now, and since September they've also been used for (Paxton) door entry and (Papercut) printer login tokens. They've generally worked very well - we've not rolled out to pupils yet, but might consider the Year 10s / 11s. People have them on their keyrings to use like they would door keys, and making them use the same keys for door entry has made sure they actually bring them in to school every day.

 

There's been few problems, just a couple of small gotcha's: our nice, compact all-in-ones have side-mounted USB ports hidden away behind the screen, and mounted the wrong way around for someone to be able to press the touch pad with their finger when using the key. A short (30cm) USB extension cable solves that. Also, the USB interface is of the thin style, so it can be put in a port upside down, which can confuse some users.

 

The NFC-capable Feitian K9 was a little cheaper than the Ubikey equivilant - we bought in bulk, a quick Google suggest around £20 each, which sounds about right, maybe a bit cheaper if you're buying 1,400.

 

They were easy enough to set up for use with our printers - the printers have USB-connected NFC sensors and are managed by PaperCut, we have one of the same NFC sensors on an admin PC we use to set the keys up. You'll probably need to buy the sensors via whoever manages your printers, which is going to depend on your provider.

 

I bought a couple of Thetis Pros for my own use, around £25:

 

https://www.amazon.co.uk/gp/product/B0BJP64YTT/ref=as_li_tl?ie=UTF8&camp=1789&tag=amzn-lnkeg-21&creative=390957&creativeASIN=B0BJP64YTT&linkCode=as2

 

Has both USB A and USB C interfaces and NFC. I find the press-able button easier to use than the capacitive touch ones used on the Feitian keys, which can take a few seconds / bit of finger-wiggling to get to register a touch.

Edited October 14, 2024 by dhicks

[PotNoodleTech]

Reading this thread with interest. Generally if a company doesnt list prices for USB key fob things then they're likely to be ooooooo expensivo.

[PotNoodleTech]

I bought a couple of Thetis Pros for my own use, around £25:

 

https://www.amazon.co.uk/gp/product/B0BJP64YTT/ref=as_li_tl?ie=UTF8&camp=1789&tag=amzn-lnkeg-21&creative=390957&creativeASIN=B0BJP64YTT&linkCode=as2

 

Has both USB A and USB C interfaces and NFC. I find the press-able button easier to use than the capacitive touch ones used on the Feitian keys, which can take a few seconds / bit of finger-wiggling to get to register a touch.

 

Getting finance to order 2 of these for me and my tech to try out. Thanks

[snagrat]

We have the Feitian K9 rolled out to all staff (around 100):

 

https://www.ftsafe.com/products/FIDO/NFC

 

They use both USB and NFC, we've had staff using them as 2FA keys for a couple of years now, and since September they've also been used for (Paxton) door entry and (Papercut) printer login tokens. They've generally worked very well - we've not rolled out to pupils yet, but might consider the Year 10s / 11s. People have them on their keyrings to use like they would door keys, and making them use the same keys for door entry has made sure they actually bring them in to school every day.

 

There's been few problems, just a couple of small gotcha's: our nice, compact all-in-ones have side-mounted USB ports hidden away behind the screen, and mounted the wrong way around for someone to be able to press the touch pad with their finger when using the key. A short (30cm) USB extension cable solves that. Also, the USB interface is of the thin style, so it can be put in a port upside down, which can confuse some users.

 

The NFC-capable Feitian K9 was a little cheaper than the Ubikey equivilant - we bought in bulk, a quick Google suggest around £20 each, which sounds about right, maybe a bit cheaper if you're buying 1,400.

 

They were easy enough to set up for use with our printers - the printers have USB-connected NFC sensors and are managed by PaperCut, we have one of the same NFC sensors on an admin PC we use to set the keys up. You'll probably need to buy the sensors via whoever manages your printers, which is going to depend on your provider.

 

I bought a couple of Thetis Pros for my own use, around £25:

 

https://www.amazon.co.uk/gp/product/B0BJP64YTT/ref=as_li_tl?ie=UTF8&camp=1789&tag=amzn-lnkeg-21&creative=390957&creativeASIN=B0BJP64YTT&linkCode=as2

 

Has both USB A and USB C interfaces and NFC. I find the press-able button easier to use than the capacitive touch ones used on the Feitian keys, which can take a few seconds / bit of finger-wiggling to get to register a touch.

Only problem with the K9 is it is USB-A and many of our devices do not have these port any more. The dual USB-A/USB-C models would be better but seem more expensive.

[RLR]

We have a few users trialing these at the moment:

https://www.yubico.com/gb/product/security-key-series/security-key-nfc-by-yubico-black/

[Julian]

If you are trying to future proof your options, look for a key with USB A, USB C , and NFC.