Technical Tip: How to provision FortiToken with a third-party 2FA app (Google, Microsoft Authenticator)

[kiri]

Description	This article describes how to provision a mobile FortiToken with a third-party 2FA app, such as Google or Microsoft Authenticator, when the FortiToken Mobile app cannot be used or enforced. This method is an exception: end users should primarily use the FortiToken Mobile app. Push notifications are not supported with these Tokens.
Scope	FortiAuthenticator v6.6.3 and newer, Mobile FortiToken.
Solution	Adjust provisioning settings: Under System → Auth → User Account Policies → Tokens, change FortiToken Mobile Provisioning Time Step from the default 60 sec to 30 sec. This is a global setting, and all provisioned tokens will use 30 sec going forward. Switch the Token to third-party provisioning mode, and a couple of General API usage are required, as shown below. Retrieve the ID of a user: curl -k -v -u "api-adm:NlLLwXApSkRCrmrkg3TYV" -H 'Accept: application/json' "https://10.5.20.234/api/v1/localusers/?format=json&username=test_user3" Example response snippet: ..."id": 95,..."username": "test_user3"}]} With the user ID, provision a token serial number (SN): curl -k -v -u "api-adm:NlLLwXApSkRCrmrkg3TYV" -X PATCH -d ' {"token_type":"ftm","token_auth":"true","token_serial":"FTKMOB444A28C1E8"}' -H 'Content-Type: application/json' https://10.5.20.234/api/v1/localusers/95/?returnseed=2  Verify Token provisioning in the FortiAuthenticator admin GUI: Navigate under System → Auth → User Mgmt → Local Users. The Activation delivery method should now be a Third-party app. Select Validate Token to confirm the setup. Provision with Google or Microsoft Authenticator: Scan the QR code to complete the setup. Alternatively, if QR code provisioning is not possible, use the Token SN as the account name and the Activation Code as the key/seed/secret to manually provision it. Activate the Token: Input the generated code and select 'Submit'. Scroll down and select 'Save'. Check Auth → User Mgmt → FortiTokens, Token status is now Assigned: FTKMOB444A28C1E8 FortiToken Mobile (3rd-party app) Assigned 2025-06-09T08:04:30 Local: test_user3 TOTP 6 -1 30