> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Modify Legacy Token settings

Legacy tokens are older model tokens supported by Entrust Identity Enterprise (formerly Entrust IdentityGuard). IDaaS supports legacy tokens for the migration of Entrust Identity Enterprise users to the cloud.

Use this page only if your organization is migrating users who still use legacy hardware tokens. If you are deploying standard OATH hardware tokens, use [Modify hardware token settings](/docs/authentication-and-security/manage-authenticators/manage-hardware-tokens/modify-hardware-token-settings.md).

Before you update these values, confirm the expected authentication behavior in your current environment. Large changes to time or event windows can increase support requests if users' tokens are already close to policy limits.

### Modify Legacy token settings

1. Click Menu icon **>** **Policies > Authenticators**. The **Authenticators** page appears.

2. Select **Legacy Token**. The **Legacy Token** settings appear.

3. Set **Max. Time Steps** to define how long a token response remains valid during normal authentication.

   > This setting defines the number of time steps that are searched to find a matching user response during authentication. A value of `1` equates to `30` seconds. The default value is `10`, or `300` seconds.

4. Set **Max Reset Clock Window** to the number of minutes that IDaaS searches to find a matching user response during a token reset operation.

   > The value must be between `1` and `120` (or two hours). The default value is `10` minutes.

5. Set **Max Event Window** to the numbers of token responses that are searched to find a matching user response during authentication. The value entered must be less than the **Max Reset Event Window**.

   > The value must be between `10` and `200`, in increments of `10`. The default value is `100`.

6. Set **Max Reset Event Window** to the number of token responses that IDaaS searches during a token reset operation.

   > The value must be between `10` and `5000`, in increments of `10`. The default value is `100`.

7. Click **Save**.

## Validate your changes

After you save, verify the following:

1. A test user can complete normal token authentication within the configured **Max. Time Steps** and **Max Event Window** limits.
2. Token reset succeeds within the configured **Max Reset Clock Window** and **Max Reset Event Window** values.
3. Authentication failures do not increase unexpectedly after the policy update.