> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Assign hardware tokens

You can assign a hardware token to a user after the token seed file is imported into your IDaaS account. A hardware token can be assigned to only one user at a time, but a user can have multiple hardware tokens. After users are assigned hardware tokens, update your resource rules as required so they can authenticate to their application accounts using hardware tokens.
You can assign tokens directly to users, or users can self-assign them after you send the tokens to them.

Before you start, confirm the following:

- The hardware token seed file is already imported.
- The target user account exists and is active.
- The token serial number is available and currently unassigned.

## Assign hardware tokens to users

Hardware tokens can be assigned to users as follows:

- [From the Tokens page](#assign-hardware-tokens-from-the-tokens-page)
- [From the Authenticators page](#assign-hardware-tokens-from-the-authenticators-page)
- [In bulk](#assign-hardware-tokens-in-bulk)

### Assign hardware tokens from the Tokens page

1. Click Menu icon **>** **Resources > Tokens**. The **Tokens** page appears.
2. Click **Unassigned**. The list of unassigned hardware tokens appears.
3. Identify the serial number of the token you want to assign to your user. You can use the filter option to search for a token (see [Manage hardware tokens](/docs/authentication-and-security/manage-authenticators/manage-hardware-tokens.md) for more information on filtering tokens).
4. Click User Plus icon for the hardware token you want to assign to a user. The **Assign Hardware Token** dialog box appears.
5. In the **User ID** field enter the user's IDaaS user ID.
6. Click **Assign**. The user is assigned the token and can now use it to complete second-factor authentication.
7. Click **Assigned**. The token appears in the **Assigned** list.

After assignment, verify that the token appears in the **Assigned** list and is linked to the expected user.

### Assign hardware tokens from the Authenticators page

1. Click Menu icon **>** **Members > Users**. The **User List** page appears.
2. Click the user ID of the user being assigned the hardware token. The **User Details** page appears.
3. Click the **Authenticators** tab. The user's list of assigned authenticators appears.
4. Click Circle Plus icon. A drop-down list of authenticators appears.
5. Select **Hardware Token**. The **Assign Hardware Token** dialog box appears.
6. In the **Token Serial Number** field, enter the hardware token serial number.
7. Click **Assign**. The authenticator is assigned to the user.

After assignment, confirm the token appears in the user's **Authenticators** tab.

### Assign hardware tokens in bulk

See [Bulk assign authenticators](/docs/perform-bulk-operations/bulk-assign-authenticators.md).

## User self-assigns hardware token

The administrator can have the user self-assign the hardware token.

Send the hardware token and serial number to the user, then instruct the user to complete self-assignment in the User Portal.

note

Before you begin, upload the token data file to your IDaaS account. See [Import hardware tokens](/docs/perform-bulk-operations/bulk-import-operations/import-hardware-tokens.md) for more information.

## Edit group membership

If you need to change the group membership for a hardware token before assigning it to a user, do the following:

1. Click Menu icon **>** **Resources > Tokens**. The **Tokens** page appears.
2. Click Pencil icon next to the hardware token. The **Edit Token** dialog box appears.
3. Add or delete groups as required.
4. Click **Submit**.

## Validate your changes

After you assign tokens or edit group membership, verify the following:

1. The token is assigned to the expected user and no longer appears in the unassigned token list.
2. The user can see and use the assigned token for authentication.
3. Group membership changes are saved for the selected token.