There are 2 ways you can enroll SafeID hardware OTP tokens in Azure AD 

• Use Azure AD Portal and PowerShell script
• Use SafeID Token Service

Use Azure AD Portal

Enrolling an OTP token into Azure AD involves 3 steps:

1. Upload the token to Azure AD
2. Assign the token to a user
3. Activate the token 

Azure AD portal provides a very basic facility that allows you to assign & upload tokens in bulk, but it does not provide a facility for activating tokens in bulk. We have to write a PowerShell script for bulk activation. 

If you have a large number of SafeID tokens to manage, then you might want to use the SafeID Token Service.

Use SafeID Token Service

SafeID Token Service (STS) is a product/service that we have developed for customers who need to manage a large quantity of SafeID tokens with Azure AD. 

SafeID Token Service provides a Web-based GUI console that allows customers to manage the full life cycle of the SafeID token by simply pointing and clicking. You can assign, activate, deactivate, unassign, delete and replace a token, etc with one single click.

For more details, click SafeID Token Service