diff --git a/privacyidea/api/token.py b/privacyidea/api/token.py
index 02b8f3be6206d0e0f1994c268f910bfe5ed47f4c..8160ba1009adc63fef6de917a2b6141d5ff9b01a 100644
--- a/privacyidea/api/token.py
+++ b/privacyidea/api/token.py
@@ -281,10 +281,12 @@ def enable_mfa_everywhere(user):
 def update_user_active_token_types(user, all_user_tokens=None):
     usable_tokens = get_usable_tokens(user, all_user_tokens)
     active_token_types = [token["tokentype"] for token in usable_tokens]
+    unique_active_token_types = list(set(active_token_types))
+    unique_active_token_types.sort()
 
     cfg = current_app.config
     mfa_active_tokens_attr_name = cfg.get("PERUN_AVAILABLE_TOKEN_TYPES_ATTR_NAME")
-    mfa_active_tokens_attr_value = active_token_types
+    mfa_active_tokens_attr_value = unique_active_token_types
     mfa_enforce_action_name = "Update of user's active token types"
 
     set_perun_user_attributes(user,