Software OTP and push authentication
FortiGate, FortiAuthenticator or FortiIdentity Cloud
Device-managed quantities from 5 to 10,000
Current transfer restrictions must be checked
Direct answer for buyers
FortiToken Mobile Series is Fortinet’s software-token approach for multi-factor authentication, using an application that can generate OATH-compliant time-based or event-based one-time passwords and support push approval in suitable Fortinet deployments. It is mainly considered by organisations that want stronger authentication for users, remote access, administrators or protected applications without distributing a separate OTP device to every person. Buyers should confirm the required number of users, the validation and management platform, whether the deployment will be device-managed or cloud-managed, the exact license quantity, and the current license-transfer rules before ordering. Compatibility, activation and support expectations should be reviewed as part of the bill of materials rather than assumed from the app alone.
What FortiToken Mobile does
FortiToken Mobile turns a supported user device into an authentication token. Instead of relying on a username and password alone, the user can provide an additional one-time password or, in supported configurations, respond to a push request. The current Fortinet data sheet identifies OATH time-based and event-based OTP support, along with one-tap approval, app security controls and over-the-air activation. In practical terms, this gives IT teams a way to extend multi-factor authentication to employees, contractors or administrators while using devices many users already carry.
Who should consider it
The family is relevant to organisations already using, or planning to use, FortiGate, FortiAuthenticator or FortiIdentity Cloud for identity and access workflows. It can fit small deployments that need a limited number of software tokens and larger environments that need hundreds or thousands, provided the selected platform’s capacity and license architecture are verified. It may also be suitable where physical hardware tokens would create unnecessary distribution overhead. Organisations with strict policies around personal-device usage, shared devices, offline user processes or mandatory hardware-backed authentication should compare mobile tokens with FortiToken 210, FortiToken 310, FortiToken 410/411 or another approved authentication method before deciding.
Business problems this family can help address
The strongest reason to evaluate FortiToken Mobile is not the application itself; it is the operational problem created when passwords are the only barrier between a user and an important business resource. The cards below translate that problem into practical buying considerations.
Password-only remote access
VPN and remote-access accounts are attractive targets when credentials are exposed. A second factor can reduce reliance on the password alone, provided the authentication policy and user-enrolment process are configured correctly.
Administrator account risk
Privileged logins deserve stronger controls because a compromised administrator account can carry broader impact. FortiToken Mobile can be incorporated into supported Fortinet administrative authentication designs after compatibility and recovery processes are defined.
Hardware-token logistics
Issuing physical tokens can involve storage, handover, replacement and return processes. A mobile application may reduce those logistics for users who are allowed to use compatible phones or computers, although device policy and security controls remain important.
Scattered authentication management
As the number of users and Fortinet devices grows, teams may want more centralised identity management. FortiAuthenticator or FortiIdentity Cloud may be considered depending on architecture, scale and the desired management model.
Core capabilities buyers should understand
OATH OTP generation
The current data sheet lists RFC 6238 and RFC 4226 support, covering time-based and event-based one-time-password methods. This is central to how the mobile token can provide a second authentication factor.
Push approval
Suitable Fortinet workflows can push login details to the user for one-tap approval. Push behaviour depends on the platform, policy, connectivity and deployment architecture and should be tested before broad rollout.
Application protection
Fortinet documents PIN, fingerprint or facial protection options, serial-number display, token and app management, and self-erase brute-force protection. Actual device capabilities can vary by platform and operating-system support.
Online activation
Tokens can be provisioned through supported Fortinet platforms, and Wi-Fi-only devices can be used for over-the-air token activation. Buyers should include enrolment, replacement and recovery procedures in deployment planning.
FortiToken Mobile fit matrix
| Requirement | Suitable when | Confirm before ordering |
|---|---|---|
| Mobile software token | Users can run a supported FortiToken application on approved devices. | Device policy, operating-system support, enrolment process and recovery path. |
| FortiGate-managed MFA | A FortiGate can act as the authentication server for the intended access case. | FortiOS version, user scale, HA design, exact login workflow and license registration. |
| Centralised identity management | Multiple systems or a broader identity service require central management. | FortiAuthenticator or FortiIdentity Cloud architecture, capacity and integration requirements. |
| Perpetual device-managed tokens | The organisation prefers perpetual software-token quantities tied to the selected management platform. | Exact FTM-ELIC quantity and current restriction on transferring licenses between devices. |
| Cloud-managed identity | The business wants SaaS-based authentication management and the wider FortiIdentity Cloud capabilities. | Subscription tier, minimum quantities, identity integrations, regional terms and migration path. |
Verified family information
FortiToken Mobile is a product family rather than one fixed hardware appliance, so the most useful specification view is a set of shared software-token characteristics and current ordering choices. Quantities and architecture should not be blended into a single assumed configuration.
| Brand | Fortinet |
| Product family | FortiToken Mobile |
| Product type | Software one-time-password token / multi-factor authentication client |
| OTP standards | OATH time-based and event-based OTP; RFC 6238 and RFC 4226 listed by Fortinet |
| Supported platforms in current data sheet | iOS, Android, Windows 10 and Windows 11; Apple Watch compatibility is also listed |
| Authentication experience | OTP generation and login details pushed to the device for one-tap approval in supported workflows |
| Management / validation options | FortiGate, FortiAuthenticator and FortiIdentity Cloud, depending on architecture and licensing |
| Device-managed software-token SKUs | FTM-ELIC-5, -10, -25, -50, -100, -200, -500, -1000, -2000, -5000 and -10000 |
| Device-managed license type | Perpetual software-token licensing according to current Fortinet ordering information |
| License transfer | Not allowed for device-managed FortiToken Mobile licenses shipped on or after 4 August 2025 |
| Cloud-managed option | FortiIdentity Cloud subscription; current FortiToken ordering guide shows a minimum order quantity of 25 for cloud-based MFA bundles |
| Availability | Contact FourTeck for current UAE model, license and vendor lead-time guidance |
| Important note | Platform capacity, supported login use cases, migration eligibility, push behaviour and regional commercial terms are configuration or subscription dependent. |
Licensing and transfer dependencies deserve special attention
Older FortiToken material and third-party listings may describe mobile-token transfers differently. Current Fortinet ordering documentation is more specific: license transfer is not allowed for device-managed licenses shipped on or after 4 August 2025. This matters when a business expects to move tokens between appliances during refresh, replacement, consolidation or migration. The restriction should be treated as a procurement requirement, not an afterthought.
A project that expects frequent hardware replacement, multi-appliance reassignment or cloud migration should therefore be designed with the latest Fortinet policy in mind. For cloud-managed projects, FortiIdentity Cloud has its own subscription and migration rules. FourTeck can help identify the intended management path and prepare a quotation around the exact number of users, but final licensing entitlement and transfer eligibility should be confirmed against current Fortinet terms at the time of order.
A practical purchase and deployment journey
Define protected access
List the VPN, administrator, portal, application or other authentication workflows that require a second factor. This establishes what must be supported and tested.
Count users accurately
Separate named users, contractors, administrators, test accounts and future growth. Match that quantity to the correct license block rather than assuming one token per device or one license per site.
Choose management model
Decide whether tokens will be managed on FortiGate, centrally through FortiAuthenticator, or through FortiIdentity Cloud. The choice affects architecture, licensing and operations.
Plan enrolment and recovery
Document how users receive activation, what happens when phones are replaced, how lost devices are handled, and who is authorised to reset or reissue tokens.
Validate before rollout
Test representative users, push and OTP flows, failover behaviour, help-desk procedures and logging. Only then expand the policy to the wider user population.
Capability focus: flexible OTP for mobile users
One-time passwords remain useful where a user needs a second factor that can be generated locally on a supported device. FortiToken Mobile supports OATH time-based and event-based OTP methods, so it can fit authentication processes that are designed around standard OTP validation rather than a hardware display token. For a buyer, the operational advantage is reduced dependence on physical token distribution.
That does not mean every user should automatically receive a mobile token. Device ownership, mobile-device policy, travel patterns, shared workstations and accessibility requirements can influence suitability. Organisations should also plan what happens if a user cannot access the registered device. A well-designed recovery process is part of the authentication system and should be tested just as carefully as normal login.
Capability focus: push convenience with policy control
Push approval can reduce the effort of manually reading and entering OTP codes. Fortinet’s current data sheet lists one-tap approval with login details pushed to the phone, which can make repeated business authentication more manageable for users. The control remains dependent on the validation platform, connectivity and configured policy.
Convenience should not replace user awareness. Organisations should teach users to reject unexpected authentication prompts and report repeated unsolicited requests. IT teams should also review logs and access policy rather than treating every approved push as automatically trustworthy. For environments with higher assurance requirements, compare mobile push and OTP with FIDO-based or certificate-based authentication options before standardising on one method.
Capability focus: fit with the Fortinet identity stack
FortiToken Mobile is most useful when it is considered as part of a wider authentication design. FortiGate can validate OTP for supported access scenarios, FortiAuthenticator can centralise identity and authentication functions, and FortiIdentity Cloud offers a SaaS management model with broader identity capabilities. The correct choice depends on the number of systems, users, sites and integrations involved.
A single-site FortiGate project and a multi-country identity rollout may both use mobile authentication but need very different architectures. Buyers should therefore avoid selecting token quantities before confirming where identity will be mastered, how users are synchronised, what directory is involved, whether single sign-on is required and how authentication remains available during maintenance or platform failover.
Ideal business environments and use cases
FortiToken Mobile can support several common business patterns, but suitability depends on identity design and organisational policy. The following examples are intended as decision guidance rather than a promise that one configuration fits every environment.
Remote and hybrid work
Users connecting through supported remote-access workflows can be required to provide a second factor. Confirm VPN design, authentication source, user volume and recovery procedures.
Privileged administration
Security and network administrators can be placed under stronger authentication policy. Confirm how break-glass access, emergency credentials and HA events will be managed.
Multi-branch Fortinet estates
A business with multiple FortiGate devices may consider central management through FortiAuthenticator or a cloud identity model rather than treating each branch independently.
Contractor access
Temporary or external users may need stronger authentication, but token ownership, expiration of access and offboarding need explicit procedures so licenses and identities do not remain unmanaged.
Regulated workflows
Where policy requires MFA, mobile tokens can be one candidate method. The organisation must confirm whether its own regulatory or internal assurance requirements accept software OTP or push for the specific workflow.
User populations without hardware tokens
Mobile authentication can reduce physical-token logistics when users are permitted to use supported devices. BYOD, corporate-device and privacy policy should be clarified in advance.
Integration and operational considerations
Authentication systems sit in the middle of user access, which means operational details are often more important than the token purchase itself. Before deployment, map the identity source, the Fortinet component that validates the token, user groups, remote-access profiles, administrator roles and any RADIUS, SAML, OIDC or directory dependencies involved in the broader design. Not every integration is a capability of FortiToken Mobile itself; many are provided by FortiAuthenticator, FortiIdentity Cloud or another part of the environment.
Plan for enrolment communications, activation failures, lost or replaced devices, mobile operating-system updates, deactivated employees, shared accounts and emergency access. Help-desk teams should know which issues can be handled locally and which require Fortinet support or license assistance. Where high availability is used, confirm how token validation and configuration behave during failover and maintenance. For projects with multiple FortiGate devices, token registration and transfer policy should be evaluated early so an appliance refresh does not reveal an unexpected licensing constraint.
Logging should also be considered. Multi-factor authentication adds value when administrators can review login attempts, failed challenges and policy decisions in context. Retention, monitoring and alerting depend on the surrounding platform and organisational logging architecture. FourTeck can discuss the required configuration scope alongside its business technology services so the quotation reflects more than the license certificate alone.
Questions to resolve before requesting a quotation
Count users by authentication requirement, not merely by employees or devices. Include administrators, external users and planned growth.
Identify the FortiGate, FortiAuthenticator or FortiIdentity Cloud design and confirm version, capacity and policy requirements.
Device-managed FTM-ELIC quantities are perpetual; cloud-managed identity uses FortiIdentity Cloud subscription licensing.
Current transfer restrictions are a major design factor for appliance replacement, migration and consolidation.
Clarify whether the requirement is license supply only or includes configuration, enrolment planning, testing and handover.
Define token replacement and recovery before rollout. Device replacement policy should not be discovered during an urgent support call.
Procurement checklist for FortiToken Mobile
How FourTeck can support sizing and configuration planning
A FortiToken Mobile quotation is more useful when the license quantity is tied to a clearly defined architecture. FourTeck can help businesses describe the protected access scenario, estimate the appropriate token block, identify the intended Fortinet validation platform and discuss whether a device-managed perpetual model or FortiIdentity Cloud should be evaluated. This is especially valuable when an organisation already owns FortiGate appliances and wants to understand whether existing infrastructure can provide the required authentication function or whether centralised identity services are needed.
For configuration projects, the scope can include discussion of user groups, authentication policies, enrolment approach, test users, remote-access behaviour, administrator MFA and handover needs. Any final configuration work should be based on the customer’s actual Fortinet versions, directory services, network design and security policy. For broader Fortinet planning, buyers can also review FourTeck’s Fortinet firewall guidance for Dubai or the Fortinet UAE technology resource.
The objective is to avoid over-ordering, under-ordering or selecting a license architecture that conflicts with a planned appliance refresh. Share the FortiGate or FortiAuthenticator model, software version, current user count, expected growth, remote-access method and any existing token licenses when requesting assistance.
UAE availability and support guidance
Contact FourTeck to confirm current UAE availability for the required FortiToken Mobile license quantity or FortiIdentity Cloud subscription. Availability may depend on license type, user quantity, regional commercial terms, vendor processing and the exact Fortinet account or appliance involved. Because FortiToken Mobile is delivered as software licensing rather than a conventional stocked appliance, procurement teams should focus on entitlement accuracy, registration details and delivery of the correct electronic license information.
If configuration or deployment assistance is required, include that scope in the quotation request rather than assuming it is part of the license. FourTeck can coordinate requirement review, sizing discussion, quotation preparation and implementation planning after the exact environment is known. Buyers can contact the FourTeck team with user counts and platform details for current guidance.
Dubai, Abu Dhabi, Sharjah and Ajman project coverage
Businesses operating in Dubai, Abu Dhabi, Sharjah and Ajman can discuss FortiToken Mobile licensing, Fortinet identity design and implementation requirements with FourTeck through one coordinated requirement review. The most useful starting information is the organisation’s main deployment location, number of users, FortiGate or FortiAuthenticator details, required authentication workflow and whether the project is new, an expansion or a migration. Delivery of electronic licensing and any associated installation or configuration work should be scheduled only after the exact bill of materials and project responsibilities are agreed. For related security products, see FourTeck’s network security product portfolio.
GCC Availability
For GCC organisations, FortiToken Mobile planning should start with the destination country, user count and management architecture rather than an assumed regional price or entitlement. FourTeck can assist businesses evaluating requirements across the United Arab Emirates, Saudi Arabia, Kuwait, Qatar, Bahrain and Oman with model and license review, quotation coordination, configuration-scope discussion and deployment planning. A device-managed FortiToken Mobile license and a FortiIdentity Cloud subscription follow different commercial and operational models, so the requested option should be stated clearly.
Product availability, licensing terms, vendor lead times, service visits and project scope can vary by country, quantity and requirement. Organisations should provide the destination country, required FTM-ELIC quantity or cloud-user tier, relevant Fortinet platform details, preferred deployment schedule and any installation or support expectations. Regional buyers may also use FourTeck’s Kuwait technology resource when coordinating projects there. Current local inventory, customs outcomes, fixed delivery times or country-specific certifications should always be confirmed separately before commitment.
Africa Availability
Organisations planning FortiToken Mobile deployments in Africa can work with FourTeck to review software-token quantities, Fortinet platform dependencies, subscription choices, enrolment processes and support expectations before procurement. This is particularly useful for businesses with distributed users across East Africa, West Africa, Southern Africa or Central Africa where identity policy may be common but local operational conditions differ. A central design may need to account for connectivity, device policy, regional support responsibilities and how tokens are issued to users in different offices.
Availability and fulfilment can depend on the destination, license region, user quantity, vendor processing, deployment architecture and local project conditions. Buyers should share the destination country, exact license requirement, expected user count, preferred deployment schedule and whether configuration or migration assistance is needed. FourTeck’s Africa technology resource can support broader regional planning, while current licensing, service coverage and delivery arrangements should be confirmed for the specific project rather than assumed from another country.
What buyers are really trying to decide before choosing mobile MFA
Many buyers begin with a simple question: “How much does FortiToken Mobile cost?” The more useful question is “Which licensing and management path fits our environment?” The app itself is not the complete solution. It needs a supported validation service or platform, a token entitlement, an enrolment process and an access policy. That is why quotations can differ significantly even when two organisations have the same number of users.
Is FortiToken Mobile free?
The application can be downloaded from supported app stores, but business use requires an appropriate Fortinet token or identity entitlement and a platform that validates the authentication. Fortinet also publishes specific free-license conditions for some identity services, but those should not be treated as a substitute for checking the current commercial model for the planned deployment. A production quotation should therefore be based on the intended management platform and the actual number of protected users.
Do we need FortiAuthenticator?
Not always. FortiGate can directly validate FortiToken OTP for supported use cases, which can be practical for smaller or simpler deployments. FortiAuthenticator becomes relevant when the business needs centralised authentication services, broader identity functions or management across multiple systems. FortiIdentity Cloud provides another path for organisations that prefer SaaS-based management. The correct answer depends on the architecture rather than on FortiToken Mobile alone.
What license size should we buy?
For device-managed deployments, current Fortinet ordering information lists FTM-ELIC license quantities of 5, 10, 25, 50, 100, 200, 500, 1,000, 2,000, 5,000 and 10,000 software tokens. The right quantity depends on named users and future growth. Avoid buying solely from employee headcount if only certain users require MFA, but also avoid sizing so tightly that immediate onboarding creates another purchase cycle.
Can we transfer licenses during a firewall refresh?
This requires careful review. Current Fortinet ordering information states that device-managed FortiToken Mobile license transfer is not allowed for licenses shipped on or after 4 August 2025. If a FortiGate replacement, consolidation or migration is planned, raise that requirement before purchase. Older web pages or historic guidance may describe transfer differently, so the current policy should be used for design and procurement decisions.
Buyers also commonly compare FortiToken Mobile with Microsoft Authenticator, hardware OTP keys or FIDO security keys. The useful comparison is not based on brand familiarity but on the required authentication method, existing security platform, user device policy and assurance level. FortiToken Mobile is most natural when Fortinet is already central to the access path, while a FIDO key may be preferred where phishing-resistant or passwordless authentication is a primary requirement. Hardware OTP tokens can be better for users who cannot carry or are not permitted to use a smartphone.
For procurement, the clearest request includes the number of users, existing Fortinet device model and software version, whether high availability is used, the intended access workflow, and whether the project needs configuration assistance. This allows a reseller or integrator to distinguish between a simple token expansion and a wider identity project. It also makes it easier to identify whether the existing FortiGate is sufficient, FortiAuthenticator is justified, or a cloud-managed identity service should be evaluated.
Finally, treat end-user experience as a technical requirement. An MFA design that users cannot recover from when devices are replaced will generate avoidable support demand. Decide who can reset tokens, what identity checks are required before re-enrolment, how administrators are protected, and whether backup authentication methods are permitted. These operational choices influence the real quality of the deployment more than the initial license purchase alone.
Questions that shape the right FortiToken Mobile design
Should we manage tokens on FortiGate or centrally?
A FortiGate-managed approach can be efficient when the authentication requirement is closely tied to one firewall or a limited environment. Central management becomes more attractive when multiple devices, identity sources or applications are involved. FortiAuthenticator provides on-premises central authentication capabilities, while FortiIdentity Cloud offers a SaaS model. Compare operational ownership, scale and integration needs before choosing.
What information is needed for an accurate quote?
Provide the user count, desired license quantity, existing Fortinet device model, software version, deployment type, high-availability status and the access method that needs MFA. Mention existing FortiToken licenses, planned hardware replacement and whether installation or configuration is required. Those details reduce the chance that the quotation includes the wrong license architecture.
How should we prepare for phone replacement?
A token is associated with an enrolment and management context, so a phone change should follow a controlled recovery procedure. Document who verifies the user, who can remove or reissue a token, how emergency access works and whether the current license can support the required action. Current transfer restrictions make it especially important to distinguish user-device replacement procedures from moving license entitlements between Fortinet management devices.
Is push approval enough for every account?
Not necessarily. Push can improve user convenience, but privileged or high-risk workflows may justify stronger or different authentication controls. Compare push and OTP with FIDO-based security keys, certificates, contextual policy and other methods supported by the wider Fortinet identity stack. The final choice should follow the organisation’s assurance requirements, not a preference for the easiest user experience.
Can FortiToken Mobile work without mobile data?
OTP generation can operate locally once the token is provisioned, while activation and push functions require appropriate connectivity. Fortinet also documents support for Wi-Fi-only devices for over-the-air activation. The practical design should distinguish between OTP use, initial provisioning and push notifications so users understand when a network connection is required.
When should we choose a hardware token instead?
Hardware OTP or FIDO tokens can be preferable where smartphones are prohibited, users do not have supported devices, phishing-resistant passwordless authentication is required, or a physical credential is part of the security policy. FortiToken 210, 310 and 410/411 cover different hardware-based methods, so the alternative should be selected according to the required authentication mechanism rather than treated as a direct one-for-one substitute.
Related FourTeck options to consider
FortiAuthenticator
Consider when centralised authentication, identity services and token management are required across a broader environment. Sizing depends on users and architecture.
FortiIdentity Cloud
A cloud-managed identity option for organisations that want SaaS-based MFA and related identity functions. Subscription and minimum quantity rules apply.
FortiToken 210
A hardware OTP option for environments where users need a dedicated physical token rather than a mobile application.
FortiToken 410 / 411
FIDO-based security-key options for organisations considering phishing-resistant or passwordless authentication scenarios.
Why businesses contact FourTeck for this requirement
FortiToken Mobile procurement often needs more clarification than a normal software license because the value of the token depends on where it will be registered and how it will be used. FourTeck can help translate a business requirement into practical questions: which users need MFA, which Fortinet device validates them, whether current capacity is sufficient, what license quantity should be considered, and whether future hardware replacement changes the recommended approach.
This assistance can also include bill-of-material review, configuration-scope planning, migration discussion, compatibility review and quotation coordination. It does not replace the need to confirm current Fortinet licensing terms, software support and regional availability for the final order. Buyers who are still defining their overall security design can start from the FourTeck Firewall Dubai portal and bring the existing network details into the consultation.
A well-prepared request usually produces a better outcome than asking only for a price. Include user count, Fortinet models, software versions, existing licenses, expected growth and deployment objectives so that licensing and technical assumptions can be resolved before purchase.
Frequently asked questions
What is FortiToken Mobile Series used for?
It is used to provide software-based multi-factor authentication through one-time passwords and, in supported deployments, push approval. It works as part of a Fortinet authentication design rather than as a standalone access-control system.
Which Fortinet platforms can manage or validate FortiToken Mobile?
Fortinet currently documents use with FortiGate, FortiAuthenticator and FortiIdentity Cloud. The right platform depends on the authentication workflow, user scale, management preference and broader identity architecture.
What device-managed license quantities are available?
Current Fortinet ordering information lists FTM-ELIC quantities for 5, 10, 25, 50, 100, 200, 500, 1,000, 2,000, 5,000 and 10,000 software tokens. Confirm the exact SKU before ordering.
Are FortiToken Mobile device-managed licenses perpetual?
Yes, the current Fortinet ordering guide describes the device-managed FTM-ELIC software-token quantities as perpetual licenses. FortiIdentity Cloud uses a subscription model, so the two approaches should not be confused.
Can FortiToken Mobile licenses be transferred between Fortinet devices?
Current Fortinet guidance states that license transfer is not allowed for device-managed FortiToken Mobile licenses shipped on or after 4 August 2025. Confirm current policy before any refresh or migration project.
Which operating systems are supported?
The current Fortinet data sheet lists iOS, Android, Windows 10 and Windows 11 for FortiToken Mobile and also lists Apple Watch compatibility. Check the latest app and operating-system support before deployment.
Does FortiToken Mobile support push authentication?
Yes, Fortinet documents login details being pushed to the phone for one-tap approval. Push operation depends on a supported deployment, policy and network connectivity.
What should we send FourTeck for a quotation?
Share the number of users, required license quantity if known, FortiGate or FortiAuthenticator model and software version, intended authentication use case, current token licenses and whether configuration or migration support is required.
Is FortiToken Mobile available for Dubai and UAE projects?
FourTeck can assist with UAE quotation and availability guidance. Current availability, licensing, vendor lead time and implementation scope should be confirmed for the exact quantity and environment before ordering.
Prepare the correct FortiToken Mobile quotation
Share your user count, Fortinet platform, software version, current authentication method and any planned appliance refresh. FourTeck can help you confirm the license quantity, management approach and deployment scope before the order is placed.