Deploying and managing hardware security keys (HSKs) at an enterprise scale requires balancing security (phishing-resistant FIDO2/WebAuthn standards) with lifecycle logistics (onboarding, offboarding, replacement, and inventory tracking).
The industry standard and most mature ecosystem for company-wide hardware 2FA management revolves around Yubico’s enterprise solutions , complemented by identity provider (IdP) integration.
Top Enterprise Management Solutions
YubiEnterprise Subscription / YubiKey as a Service
What it is: An operational model rather than a one-off procurement event. It bundles hardware acquisition, replacement pools, and lifecycle management into a predictable per-user subscription.
Key Management Features:
Centralized Customer Portal for tracking inventory and shipments.
FIDO Pre-reg and YubiEnroll options for pre-registering keys before they even land in the user’s hands.
An annual replacement/upgrade pool (often up to 25% replacement allowance) to handle lost, broken, or upgraded keys.
Subscription reassignment when employees leave or change roles.
Learn more: Review the details directly via .[](]()]()
A management solution is only as good as its directory sync. Hardware keys must tie directly into your primary directory and authentication policies via platforms like:
Microsoft Entra ID (Azure AD)
Okta Workforce Identity Cloud
Ping Identity
These platforms allow you to enforce FIDO2 security key policies, register backup keys per user, and instantly revoke access if a key is reported lost.
The "Lost Key" Protocol: Establish a clear policy. Every employee should ideally have a primary key and a secondary/backup key registered, or a secure break-glass workflow managed through your helpdesk and IdP.
To help narrow down the ideal architecture, could you share:
Your approximate company size / user count?
Which Identity Provider (IdP) (e.g., Okta, Microsoft Entra ID, Google Workspace) you currently use?
Whether your workforce is remote, hybrid, or on-site?
For a company-wide two-factor authentication (2FA) deployment, I’d look for an enterprise hardware security key management solution, not just a vendor that sells physical keys.
The goal is to manage the full lifecycle of security keys across your workforce: purchasing, assigning keys to employees, enrolling them in identity systems, handling lost or stolen keys, enforcing phishing-resistant authentication, and recovering access when someone loses their key.
A strong solution should combine three things:
Hardware security keys: FIDO2/WebAuthn-compatible keys, such as USB-C, NFC, or USB-A models, depending on your devices.
Identity and access management (IAM): Centralized policies for enrollment, authentication, offboarding, and account recovery.
Fleet administration: Inventory, employee-to-key assignment, spare-key management, reporting, and integration with your identity provider.
One important distinction: most hardware keys do not have a universal management console. Administration often happens through your identity provider, while physical inventory and assignment are handled through a separate asset-management process.
Shortlist: enterprise solutions worth evaluating
1. YubiKey as a Service
(Best starting point for key logistics)
A managed deployment service with a centralized customer portal for user ordering, inventory visibility, shipment tracking, subscriptions, and deployment status. Pair it with your existing identity provider for authentication policies.
Best for: distributed workforces, centralized procurement, and reducing IT fulfillment work.
Provides FIDO2 security-key policies, user/group targeting, authentication-strength controls, and key registration management. Microsoft also documents API-based key provisioning, currently in preview.
This is the identity control plane, rather than a physical inventory and shipping system.
Evaluate it if you need centralized workforce authentication across many SaaS applications, with security-key support governed by your authentication policies. Confirm the precise FIDO2 enrollment, recovery, reporting, and licensing capabilities against your requirements.
Bulk rollout, enrollment tracking, and automated employee onboarding where supported
Policy enforcement
Require phishing-resistant FIDO2 authentication for designated users and applications
Inventory
Associate key serials or asset IDs with employees; track stock, shipments, and replacements
Lost-key response
Revoke the lost credential centrally and provide a secure recovery process
Redundancy
Issue a primary and backup key, especially for administrators
Compliance
For a Microsoft environment, I'd evaluate YubiKey as a Service plus Microsoft Entra ID first. This separates physical key distribution and inventory from authentication policy enforcement. The right combination will depend on your existing identity platform and whether you want a fully managed procurement process.
Indicative budget
Yubico's published purchasing documentation lists the following subscription tiers. Treat these as a starting point for budgeting and confirm current commercial terms directly with the vendor, since its program changed in January 2026.
Plan
Published price
500 users/year
Base
$15/user/year
$7,500
Advanced
$35/user/year
$17,500
Compliance
$55/user/year
$27,500
These figures are illustrative calculations from the published per-user rates, not a current quote. Confirm eligible key models, replacement allowances, shipping, taxes, and whether the plan covers the number of keys you need per employee.
Let’s narrow this down to the right architecture
The most important question is: What identity provider does your company use today?
1. Identity provider
Microsoft Entra ID (Azure AD)
Okta
Google Workspace
On-premises Active Directory
Multiple providers or another platform
2. Number of employees
Under 100
100–500
501–2,000
2,001–10,000
Over 10,000
3. What do you want to manage?
Physical keys, inventory, shipping, and replacements
Enrollment, authentication policies, and compliance
Both, end to end
4. IT environment
Cloud-only
Cloud and on-premises systems
Privileged access or highly regulated systems
5. Compliance requirements
Standard enterprise security
FIPS or government requirements
Industry-specific regulations or formal audits
[Compare solutions for my company]
With those details, I can narrow this to a practical shortlist, including whether you need a dedicated key-management service, your existing IAM platform, or a combination of both.
Yes. At enterprise scale, I’d think of the tooling in three layers: the physical-key vendor, your identity provider, and optionally a dedicated lifecycle/inventory platform.
Tool
Best fit
Enterprise capabilities
Yubico — YubiKey + YubiKey as a Service
Organizations standardizing on YubiKeys
Centralized deployment visibility, inventory, subscriptions, ordering, shipments, and user self-service through the Yubico Customer Portal.
Microsoft Entra ID
Microsoft 365 / Windows-heavy environments
Native FIDO2/passkey policies, device/model restrictions via AAGUID, attestation controls, group targeting, Conditional Access, and Windows sign-in. Microsoft also has a Graph API-based FIDO2 provisioning capability currently in preview.
Okta
Okta-centric identity environments
FIDO2/WebAuthn authentication and administrative passkey controls; importantly, Okta can block synced passkeys when an organization requires device-bound credentials.
Use your existing identity, endpoint-management, HR and ticketing systems to automate joiner/mover/leaver workflows, asset assignment, recovery and auditing.
What I'd recommend
For a new enterprise deployment, I'd generally favor:
YubiKey + your existing IdP (Entra ID or Okta) + ITSM/asset management
rather than buying a standalone "2FA management" product.
The IdP should be the source of truth for authentication, while Yubico's tooling handles the physical-key supply/inventory side. For example, Yubico's Customer Portal provides centralized visibility into inventory, users, orders and shipments.
For a Microsoft environment, Entra ID is particularly compelling because its current FIDO2 implementation supports device-bound passkey profiles, AAGUID restrictions and attestation. That lets you say, for example, "Only approved FIDO2 key models may be registered by privileged users."
Important distinction: FIDO2 vs. OTP tokens
For a new deployment, I'd strongly prefer FIDO2/WebAuthn security keys over traditional TOTP/HOTP hardware tokens.
FIDO2 keys use a device-bound cryptographic credential; the private key remains on the authenticator and the protocol provides strong resistance to phishing. Microsoft specifically recommends FIDO2 security keys for highly regulated environments and elevated-privilege users.
Duo supports both approaches, but its documentation distinguishes roaming FIDO2/WebAuthn authenticators from conventional OTP hardware tokens.
Enterprise features I'd insist on
When evaluating products, look for:
Bulk provisioning and assignment
Inventory/serial-number tracking
Automated joiner/mover/leaver workflows
Two-key strategy — primary + backup key
Lost/stolen-key revocation
FIDO2/WebAuthn rather than only OTP
Authenticator attestation/AAGUID restrictions
RBAC and delegated help-desk administration
API/SCIM/Graph integration
Audit logs and reporting
Self-service replacement workflows
Shipping/fulfillment support for geographically distributed employees
Recovery procedures that don't fall back to weak SMS/email MFA
One particularly interesting development is Microsoft's FIDO2 provisioning API, which can allow an organization's custom provisioning application to register credentials on behalf of users; it's currently documented as preview functionality.
Bottom line: if you already have Entra ID, Okta, or Duo, start there rather than introducing another authentication control plane. Add Yubico's enterprise deployment/fulfillment tooling when the operational problem becomes distributing, tracking and replacing thousands of physical keys.
If you tell me whether your environment is Microsoft Entra, Okta, Google Workspace, Duo, or mixed, I can also give you a shortlist of 5–10 enterprise tools with pricing model, APIs, provisioning capabilities, and pros/cons.
