Troubleshooting Microsoft Entra ID OATH Hardware Token Upload Errors

One security point is worth adding: the seed CSV is effectively a collection of MFA credentials. Anyone who obtains a seed can generate the same one-time codes as the physical token, so the file should be handled more carefully than an ordinary deployment spreadsheet.

Before a bulk import, create a small validation file with one assigned token. Save it as UTF-8 CSV without a BOM, confirm the exact lowercase header order, remove spaces or padding characters from the Base32 secret, and verify that the interval matches the physical token. Import and activate that one token, then test two consecutive codes before preparing the full batch.

Keep the production CSV in a restricted administrative location only for the time required to import and verify it. Do not email it, store it in a broadly shared OneDrive or SharePoint library, or include it in a support attachment. After successful activation, follow the organization's credential-retention policy and preserve only non-secret inventory data such as serial number, assignee, model, and activation status.