Customers can purchase these tokens from the vendor of their choice and use the secret key or seed in their vendor's setup process. These programmable hardware tokens can be set up using the secret key or seed obtained from the software token setup flow. Some OATH TOTP hardware tokens are programmable, meaning they don't come with a secret key or seed pre-programmed. Third-party applications that use OATH TOTP to generate codes can also be used.

The Authenticator app automatically generates codes when set up to do push notifications so a user has a backup even if their device doesn't have connectivity. Azure AD generates the secret key, or seed, that's input into the app and used to generate each OTP. Software OATH tokens are typically applications such as the Microsoft Authenticator app and other authenticator apps. Azure AD doesn't support OATH HOTP, a different code generation standard. OATH TOTP can be implemented using either software or hardware to generate the codes. OATH TOTP (Time-based One Time Password) is an open standard that specifies how one-time password (OTP) codes are generated.

Setup ms authenticator