FortiToken
FortiToken Mobile is an application for iOS or Android that acts like a hardware token but utilizes hardware the majority of users possess, a mobile phone.
Matt_B
Staff & Editor
Staff & Editor
Article Id 391007
Description This article describes an August 4, 2025, change to FortiToken Mobile license enforcement.
Scope

Any FortiToken Mobile SKUs beginning in FTM-ELIC are affected, including the following:

  • FortiToken Mobile-ELIC-5.
  • FortiToken Mobile-ELIC-10.
  • FortiToken Mobile-ELIC-25.
  • FortiToken Mobile-ELIC-100.
  • FortiToken Mobile-ELIC-500.
  • FortiToken Mobile-ELIC-1000.
  • FortiToken Mobile-ELIC-2000.
  • FortiToken Mobile-ELIC-5000.
  • FortiToken Mobile-ELIC-10000.

 

FortiToken Mobile Licenses shipped before August 4, 2025, are not subject to the change and may still be transferred between devices.

Solution

FortiToken Mobile licenses are applied to a particular FortiGate or FortiAuthenticator serial number.

FortiToken Mobile licenses shipped on or after August 4, 2025 are not transferable from one FortiGate or FortiAuthenticator device to another. The FortiToken Ordering Guide states that License Transfer for 'Device-managed FortiToken' (FortiToken Mobile) is not allowed.

 

  • If a FortiToken Mobile license was shipped before August 4, 2025, it is possible to transfer FortiToken Mobile licenses between different devices, for example, if a device is decommissioned.
  • FortiToken Mobile licenses shipped on or after August 4, 2025, cannot be transferred between different devices, except in cases of RMA. This change is due to security considerations- see the SKU description in the FortiToken Datasheet

Transferring a FortiToken Mobile license that was shipped after the policy change is only supported for RMA devices. For instructions on how to transfer configuration in case of an RMA transfer, see the article Technical Tip: Migrating users and FortiTokens to another FortiGate/FortiAuthenticator. Note this requires reprovisioning each FortiToken and is not transparent to end users.

 

If replacing a device for another reason, a new FortiToken Mobile license must be purchased and applied to the new device, and FortiToken must be re-provisioned similar to the process for RMA FortiToken transfers. See the Section on 'Migrating to FortiIdentity Cloud' below for more options.


Note:

'License transfer between devices' in the FortiToken Datasheet refers to FortiGate and FortiAuthenticator devices. Re-provisioning an existing FortiToken to a different mobile device is still supported, as is token transfer between mobile devices.

 

Products not affected:

Licensing for FortiIdentity Cloud and hardware FortiToken products remains unchanged.

 

Migrating to FortiIdentity Cloud:
An administrator may convert FortiToken Mobile licenses to a FortiIdentity Cloud (formerly FortiToken Cloud) license without the need to re-provision tokens to end-users. The procedure is documented in FortiIdentity Cloud | Migrate FTM Tokens to FortiIdentity Cloud

 

Tokens managed by FortiIdentity Cloud can be used across multiple Fortinet devices and are a subscription service rather than a perpetual license. Transferring a FortiToken Mobile license to FortiIdentity Cloud includes a free subscription for ninety days.