>[!NOTE]
>There might be up to a 20-minute delay for the policy propagation. Allow an hour for the policy to update before users can sign in with their hardware OATH token and see it in their [Security info](https://mysignins.microsoft.com/security-info).
Let's look at an example where an Authentication Policy Administrator creates a token and assigns it to a user. You can allow assignment without activation.
For the body of the POST in this example, you can find the **serialNumber** from your device and the **secretKey** is delivered to you.
This example creates a single token:
```https
POST https://graph.microsoft.com/beta/directory/authenticationMethodDevices/hardwareOathDevices
## Scenario: Admin creates and assigns a hardware OATH token that a user activates
In this scenario, an Authentication Policy Administrator creates and assigns a token, and then a user can activate it on their Security info page, or by using Microsoft Graph Explorer. When you assign a token, you can share steps for the user to sign in to [Security info](https://aka.ms/mysecurityinfo) to activate their token. They can choose **Add sign-in method** > **Hardware token**. They need to provide the hardware token serial number, which is typically on the back of the device.
>[!NOTE]
>There might be up to a 20-minute delay for the policy propagation. Allow an hour for the policy to update before users can sign in with their hardware OATH token and see it in their [Security info](https://mysignins.microsoft.com/security-info).
Let's look at an example where an Global Administrator creates a token and assigns it to a user. You can allow assignment without activation.
For the body of the POST in this example, you can find the **serialNumber** from your device and the **secretKey** is delivered to you.
This example Authentication Policy Administrator creates a single token:
```https
POST https://graph.microsoft.com/beta/directory/authenticationMethodDevices/hardwareOathDevices
## Scenario: Admin creates and assigns a hardware OATH token that a user activates
In this scenario, a Global Administrator creates and assigns a token, and then a user can activate it on their Security info page, or by using Microsoft Graph Explorer. When you assign a token, you can share steps for the user to sign in to [Security info](https://aka.ms/mysecurityinfo) to activate their token. They can choose **Add sign-in method** > **Hardware token**. They need to provide the hardware token serial number, which is typically on the back of the device.