OATH tokens stop working when "Migration Complete"

Posted by loosus@reddit | sysadmin | View on Reddit | 5 comments

Azure AD is encouraging people to migrate from legacy authentication and SSPR settings to the new one settings. You can manage your migration here: [https://portal.azure.com/#view/Microsoft\_AAD\_IAM/AuthenticationMethodsMenuBlade/\~/AdminAuthMethods](https://portal.azure.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods) We migrated our settings and then changed the migration setting to "Migration Complete." As far as we could see, everything continued working correctly. However, we later noticed that OAUTH tokens stopped working. For users with OAUTH tokens, Azure AD authentication would basically take them to a white screen and not continue. We talked to Microsoft support, and they said that we had to back our settings back to "Migration in Progress." And indeed, when we did that, OAUTH tokens worked again. Microsoft support isn't saying this is a bug, though. They're just saying "that is how it is." Which seems like it can't be correct. **Has anyone else had this experience?** FYI: this is what I mean by "OAUTH tokens:" https://www.token2.com/shop/product/token2-otpc-n1-otp-display-card-nonprogrammable-

Reply to Post

5 Comments

[-]

LowestKillCount@reddit

Do you have FIDO2 turned on in the new methods? My understanding is those tokens would be FIDO2, not OAUTH

[-]

loosus@reddit (OP)

FYI: it turns out the fix (currently) is to go back to "Migration In Progress." OATH hardware tokens are a known issue (i.e., a bug) within the new policies. Another comment in this thread directed me to documentation regarding this issue.

[-]

CountFriday@reddit

https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-authentication-methods-manage#oath-tokens Looks like there is a plan for a separate policy for Hardware OATH tokens that is not released yet. Per this documentation, you should not migrate OATH token settings yet for Hardware tokens.

[-]

loosus@reddit (OP)

Good eye. Thank you! So the fix is this: going back to "Migration In Progress" and then re-add any tokens added since "Migration Complete" was configured. I'm not sure why this second step is necessary for post-migration tokens, but it is. I hope Microsoft is planning on allowing OATH hardware tokens by the time migration is absolutely required.

[-]

Tatermen@reddit

Don't know about your problem, but I think you mean [OATH TOTP](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-oath-tokens) tokens. [OAuth](https://en.wikipedia.org/wiki/OAuth) is an authentication system, usually used by APIs. [OATH](http://openauthentication.org/) is the organization that defined the TOTP and HOTP standards.