FortiToken and Multi-Factor Authentication | Securevalley

July 2, 2026 · Nouh Droussi · Fortinet · Maroc · 4 min read · Updated September 26, 2026

OTP tokens, mobile app, FIDO2 keys: how FortiToken secures your access, and what the move from FortiToken Cloud to FortiIdentity Cloud changes.

FortiToken is Fortinet's range of authentication factors: hardware tokens, a mobile application and FIDO2 security keys. Combined with a FortiGate, FortiAuthenticator or the FortiIdentity Cloud service (formerly FortiToken Cloud), it adds a second factor to VPN access, administration portals and applications. The choice of factor you deploy directly determines the level of protection you obtain against phishing.

Why multi-factor authentication remains a priority

A password alone can be stolen through phishing, guessed, reused from a data breach or intercepted by malware. Multi-factor authentication (MFA) requires at least two elements of different types: something you know (password, PIN), something you have (phone, token, key) and something you are (biometrics). Remote access, privileged accounts and the administration interfaces of security devices are the first assets that need to be protected.

The FortiToken range

Fortinet offers several formats, which do not all address the same needs:

• FortiToken Mobile: an iOS and Android application that generates one-time passwords (OTP) and can receive push approval notifications;
• OTP hardware tokens: key fobs with a display that shows an OTP, useful for users who do not have a company smartphone or who work in areas where phones are not allowed;
• FortiToken 310: a USB token for client certificate authentication;
• FortiToken 410 and 411: FIDO-certified security keys, compatible with U2F and FIDO2, which enable phishing-resistant and even passwordless authentication.

OTP tokens follow the OATH standard and can therefore work with any compatible authentication server, including outside the Fortinet ecosystem.

Architecture: where is the second factor validated?

Three deployment models are commonly used:

• directly on the FortiGate: tokens are registered on the firewall and assigned to local or remote users (LDAP, RADIUS) for VPN and administration access; this is the simplest option for a single site;
• through FortiAuthenticator: this identity server centralizes users, tokens, RADIUS, SAML and single sign-on; it suits multi-site environments or non-Fortinet applications;
• through FortiIdentity Cloud: the SaaS service handles token enrollment and validation without requiring any on-premises server.

Product status in 2026: FortiToken Cloud becomes FortiIdentity Cloud

The FortiToken Cloud service has been renamed FortiIdentity Cloud. Beyond the change of name, Fortinet has broadened the scope of the service toward identity and access management: SAML and OIDC federation for single sign-on, context-based adaptive authentication, and passwordless options. According to Fortinet, existing tokens, licenses and integrations continue to work, and subscriptions are now renewed using FortiIdentity Cloud references. The FortiToken tokens themselves, both hardware and mobile, remain on sale.

Choosing the right factor based on risk

Not all authentication factors offer the same level of resistance to attacks. CISA points out that OTPs can be captured by a phishing page, that simple push notifications are exposed to MFA fatigue (repeated requests until the user accepts), and that SMS is vulnerable to SIM swapping. Only FIDO/WebAuthn methods and PKI-based methods are considered phishing-resistant.

In practice, a tiered approach based on the level of risk is reasonable:

• FIDO2 keys for administrators, privileged accounts and access to critical systems;
• a mobile application with push notifications, with number matching enabled where the platform supports it, for the general user population;
• SMS or email only as a temporary or fallback solution.

Deployment best practices

• Inventory the entry points: VPN, webmail, cloud consoles, administration interfaces, contractor access.
• Plan for enrollment and for the loss of a token: define a reset procedure with identity verification, and backup codes stored securely.
• Log authentications and monitor repeated denials, which may indicate an MFA fatigue attack.
• Avoid permanent exceptions: any service account without MFA must be documented, restricted and closely monitored.
• Raise user awareness: an unexpected approval request must always be denied and reported to the security team.

Skills and training

Deploying robust MFA requires mastering authentication on the firewall, as well as directory services and federated identity protocols. These learning paths will prepare you:

• FortiOS / FortiGate Administrator (NSE 4) for configuring user authentication, VPN and tokens on FortiGate (certification preparation);
• Microsoft SC-300 for identity management, conditional access and passwordless authentication in a Microsoft environment;
• CompTIA Security+ for the fundamentals of authentication and access control.

Conclusion

FortiToken covers the full range of second-factor needs, from a simple OTP to a FIDO2 key. Keep in mind that FortiToken Cloud is now called FortiIdentity Cloud, and that the level of protection depends above all on the factor you choose: reserve phishing-resistant methods for the most sensitive access.