Hardware security key management for enterprise 2FA

For a company-wide hardware security key (HSK/FIDO2) program, I’d separate the problem into two layers:

1. Identity platform — Entra ID, Okta, Google Workspace, etc. handles authentication policy and user enrollment.
2. Key lifecycle management — procurement, inventory, assignment, replacement, shipping, attestation, and recovery.

Strong enterprise options

YubiKey as a Service is the most directly relevant turnkey offering I found. Yubico's current program provides a centralized Customer Portal for deployment, inventory, rollout tracking, and user activation, plus replacement-key pools and subscription reassignment.Yubico+1

For organizations requiring stronger asset controls, Yubico's Enterprise Edition Security Keys have serial numbers for asset tracking, enforce PIN complexity, and support FIDO attestation/pre-registration capabilities.Yubico Documentation+1

Architecture I'd recommend

For a typical 500–10,000+ employee deployment:

IdP → FIDO2 policy → Security key → Key lifecycle/asset system

I'd establish:

• Two keys per employee — primary + securely stored backup.
• FIDO2/WebAuthn as the default authentication method, rather than treating the key as merely a replacement for an OTP token.
• Mandatory PINs and appropriate FIDO2 policy controls.
• Attestation where you need to restrict registration to approved hardware. Microsoft Entra, for example, supports enforcing FIDO2 attestation through its authentication-method policy.Microsoft Learn
• Central inventory tying each physical key's serial number to an employee/asset record.
• Lifecycle states such as ordered → received → assigned → active → lost → replaced → returned → retired.
• Self-service replacement with help-desk verification rather than allowing employees to simply fall back to SMS.
• A documented lost-key recovery procedure and break-glass accounts.
• Separate policies for administrators/high-risk users versus ordinary employees.
• Periodic reporting on unregistered, inactive, lost, and duplicate keys.

One important distinction

Don't confuse key-management software with enterprise HSK management.

For example, Yubico's ykman can configure FIDO2/OTP/PIV functions on individual YubiKeys, but it's a local administration tool—not by itself a company-wide asset/lifecycle management system. Yubico Similarly, Token2 has cross-platform open-source FIDO2 management tools, but those address device configuration rather than necessarily solving your complete enterprise issuance and lifecycle workflow.Token2+1

If you tell me (a) employee count, (b) whether you use Entra/Okta/Google, (c) whether you need FIPS, and (d) whether you want the keys shipped directly to employees, I can narrow this to a concrete architecture and compare Yubico vs. Token2 vs. an IdP-native approach, including estimated per-user costs and deployment workflow.

Yes. At enterprise scale, I’d think of the tooling in three layers: the physical-key vendor, your identity provider, and optionally a dedicated lifecycle/inventory platform.

What I'd recommend

For a new enterprise deployment, I'd generally favor:

YubiKey + your existing IdP (Entra ID or Okta) + ITSM/asset management

rather than buying a standalone "2FA management" product.

The IdP should be the source of truth for authentication, while Yubico's tooling handles the physical-key supply/inventory side. For example, Yubico's Customer Portal provides centralized visibility into inventory, users, orders and shipments.www.yubico.com

For a Microsoft environment, Entra ID is particularly compelling because its current FIDO2 implementation supports device-bound passkey profiles, AAGUID restrictions and attestation. That lets you say, for example, "Only approved FIDO2 key models may be registered by privileged users."learn.microsoft.com+1

Important distinction: FIDO2 vs. OTP tokens

For a new deployment, I'd strongly prefer FIDO2/WebAuthn security keys over traditional TOTP/HOTP hardware tokens.

FIDO2 keys use a device-bound cryptographic credential; the private key remains on the authenticator and the protocol provides strong resistance to phishing. Microsoft specifically recommends FIDO2 security keys for highly regulated environments and elevated-privilege users.learn.microsoft.com

Duo supports both approaches, but its documentation distinguishes roaming FIDO2/WebAuthn authenticators from conventional OTP hardware tokens.duo.com

Enterprise features I'd insist on

When evaluating products, look for:

• Bulk provisioning and assignment
• Inventory/serial-number tracking
• Automated joiner/mover/leaver workflows
• Two-key strategy — primary + backup key
• Lost/stolen-key revocation
• FIDO2/WebAuthn rather than only OTP
• Authenticator attestation/AAGUID restrictions
• RBAC and delegated help-desk administration
• API/SCIM/Graph integration
• Audit logs and reporting
• Self-service replacement workflows
• Shipping/fulfillment support for geographically distributed employees
• Recovery procedures that don't fall back to weak SMS/email MFA

One particularly interesting development is Microsoft's FIDO2 provisioning API, which can allow an organization's custom provisioning application to register credentials on behalf of users; it's currently documented as preview functionality.learn.microsoft.com+1

Bottom line: if you already have Entra ID, Okta, or Duo, start there rather than introducing another authentication control plane. Add Yubico's enterprise deployment/fulfillment tooling when the operational problem becomes distributing, tracking and replacing thousands of physical keys.

If you tell me whether your environment is Microsoft Entra, Okta, Google Workspace, Duo, or mixed, I can also give you a shortlist of 5–10 enterprise tools with pricing model, APIs, provisioning capabilities, and pros/cons.