A method or system of activating an administrator managed Fast Identity Online (FIDO) authenticator can include requesting a provisioning of a FIDO authenticator in an enterprise system at an administrator level for use by an end user where the enterprise system includes a server. As part of the provisioning, the system can designate or mark the FIDO authenticator as pending activation by the end user, and restrict use of the FIDO authenticator until the end user follows an activation flow that includes confirmation of the end user identity and includes proof of possession of the FIDO authenticator. The system allows the administrator to deliver the FIDO authenticator or token that is designated or marked as awaiting activation. The end user can then activate the FIDO authenticator or token by proving their user identity and proving possession of the FIDO authenticator.