There are two ways to set up tokens for offline MFA: download tokens automatically or create tokens manually.
If you are using the SafeID Token Service (STS) to manage your tokens, then your Entra ID domain users will be able to download offline token automatically from STS.
To enable token download from the SafeID Token Service, edit the "config.json" file and add the line below to the file
"mfa_service_endpoint": "http://mfa.safeid.io/api/clo"
When users sign in to computers using their Entra ID domain accounts, their tokens will be automatically downloaded to the computers.