I need a hardware security key (HSK) management solution for our entire company's 2FA deployment.

For an enterprise-wide hardware security key (HSK) 2FA deployment, you’ll want more than just buying keys—you’ll need a hardware authenticator lifecycle management solution covering inventory, issuance, enrollment, recovery, replacement, auditing, and integration with your identity provider (IdP).

A good architecture usually looks like this:

Core capabilities to require

• Central inventory management

• Track every key by serial number/asset ID

• Assign keys to employees, contractors, admins, and service accounts

• Track status: issued, spare, lost, revoked, retired

• Automated provisioning

• Pre-register keys before shipping to users

• Integrate with your IdP (for example, Microsoft Entra ID, Okta, Ping Identity, Google Workspace)

• Reduce help-desk involvement during onboarding

• Lifecycle controls

• New hire issuance workflow

• Lost key replacement

• Employee offboarding revocation

• Secure key recycling/reset procedures

• Policy enforcement

• Require FIDO2/WebAuthn

• Enforce PIN requirements

• Restrict weaker authentication methods

• Apply different policies for privileged users vs. general workforce

• Compliance reporting

• Who has which key?

• When was it enrolled?

• Which accounts are protected?

• Which users still rely on weaker MFA?

Solutions worth evaluating

1. Yubico enterprise ecosystem

Yubico is one of the most common enterprise choices. Its enterprise offerings support large-scale YubiKey ordering, enrollment, delivery, and management workflows.

Good fit if you want:

• YubiKey standardization
• Strong FIDO2/WebAuthn adoption
• Microsoft 365 / Entra ID environments
• Global employee deployment

Relevant components:

• yubico.com — subscription-based enterprise deployment model
• YubiEnroll — supports administrator-assisted enrollment workflows and integration with identity providers such as Okta and Microsoft Entra ID.

2. Intercede MyID

Intercede MyID is aimed at organizations needing deeper credential lifecycle management, especially where FIDO2 keys and smart-card/PIV capabilities coexist.

Good fit for:

• Government/regulated environments
• PKI + FIDO deployments
• Certificate lifecycle management

3. Appterix Security Key Management

Appterix focuses on cross-vendor security key inventory, assignment, monitoring, and lifecycle workflows.

Good fit for:

• Multi-vendor environments
• Organizations managing many thousands of tokens
• Centralized asset visibility

Recommended enterprise design

A typical deployment pattern:

Identity Provider
(Microsoft Entra ID / Okta / Ping / Google)
          |
          |
FIDO2/WebAuthn Policy Enforcement
          |
          |
HSK Management Platform
          |
          |
Hardware Keys
(YubiKey / Feitian / Nitrokey / etc.)
          |
          |
Employees + Admins + Contractors

Suggested rollout plan

Phase 1 — Pilot

• Deploy to: - IT administrators
• Security team
• Executives
• High-risk users
• Require two hardware keys per user: - Primary key
• Backup key stored securely

Phase 2 — Workforce rollout

• Integrate with HR onboarding
• Ship pre-enrolled keys
• Provide self-service replacement workflows

Phase 3 — Enforcement

• Disable SMS MFA where possible
• Require phishing-resistant MFA for privileged roles
• Monitor adoption metrics

Key purchasing questions

Before selecting a platform, determine:

1. How many users?

• <500
• 500–10,000
• 10,000+

2. Which identity platform?

• Microsoft Entra ID
• Okta
• Ping
• Google Workspace
• Custom IAM

3. Compliance requirements?

• FIPS 140-3
• FedRAMP
• HIPAA
• PCI DSS
• ISO 27001

4. Need smart card/PIV support?

• If yes, avoid FIDO-only deployments.

For most enterprises already using Microsoft 365 or Okta, I would shortlist:

1. Yubico enterprise stack for a straightforward FIDO2 rollout.
2. Intercede MyID for PKI-heavy or regulated environments.
3. Appterix for multi-vendor token inventory management.

If you share your employee count, IdP (Entra/Okta/etc.), compliance requirements, and whether you need PIV/smart-card support, I can narrow this to a recommended architecture and vendor shortlist.

Managing hardware security keys (HSKs)—like YubiKeys or similar FIDO2/WebAuthn authenticators—across an entire company requires a balance between user onboarding, lifecycle tracking, and IAM (Identity and Access Management) integration.

Unlike backend cryptographic keys managed via an Enterprise Key Management System (KMS), physical 2FA hardware tokens require operational workflows for distribution, backup mapping, loss/replacement, and revocation.

Core Pillars of an Enterprise HSK Deployment

- Your HSKs are only as good as how deeply they integrate with your primary IdP (e.g., Okta, Microsoft Entra ID, Google Workspace, or Ping Identity).
- Ensure your IdP supports **FIDO2 / WebAuthn** natively and allows administrators to enforce hardware-only policies (blocking SMS or weaker TOTP authenticators).

- **Serial Numbering:** Procure enterprise-grade keys that feature printed serial numbers or support programmatic reading where applicable (such as [[Yubico Enterprise Security Keys Go to product viewer dialog for this item.](https://www.google.com/search?ibp=oshop&prds=pvt:hg,pvo:29,mid:576462893120995618,imageDocid:8412842459021221859,gpcid:17279883888508856017,headlineOfferDocid:17696979543158218207,catalogid:12522427339099071084,productDocid:2695863428712875772&q=product&sa=X&ved=2ahUKEwj348DA9MeWAxVvvSsGHe4CBOUQxa4PeggIAggBCBAQDA) ](https://www.yubico.com/products/security-key/)).
- **Asset Tagging:** Maintain a mapping in your HRIS/ITAM system (like Jira Service Management, ServiceNow, or Snipe-IT) linking the physical key's serial number to the specific employee's UUID.[](https://www.yubico.com/products/) [[1]](https://www.yubico.com/products/)[[2]](https://www.yubico.com/products/security-key/)

- What happens when an employee loses their key or leaves it at home?
- **Policy Options:** 
	- *Secondary/Backup Key:* Issue a primary key (carried on a keychain) and a secondary backup key (kept in a secure location or registered concurrently during onboarding).
	- *Helpdesk Break-Glass Protocol:* Define a secure, identity-verified fallback method (such as a temporary, short-lived emergency OTP generated via your IdP after rigorous out-of-band verification).

- **Onboarding:** Pre-provision or drop-ship keys to remote employees. Have them register both their primary and backup keys during the initial Okta/Entra ID enrollment ceremony.
- **Offboarding:** When an employee departs, IT/Security must immediately revoke the credential mapping inside the IdP dashboard. Physical recovery of the key depends on your company asset-return policy, but revoking the WebAuthn registration neutralizes access instantly.

Recommended Implementation Framework

• Step 1: Choose Your Hardware: Standardize on FIDO2/NFC-enabled keys (e.g., USB-A and USB-C variations depending on your fleet of laptops). Consider programs like YubiKey as a Service if you prefer predictable annual lifecycle refreshes.
• Step 2: Configure IdP Enforcement: Build a staged rollout. Start with privileged users (admins, execs, finance), move to engineering/R&D, and then scale company-wide. Set conditional access policies requiring FIDO2 touch for sensitive apps.
• Step 3: Document the Loss Process: Create a self-service or rapid-response IT ticket type for "Lost Security Key" so that revoking and re-provisioning takes minutes rather than days.

If you'd like to narrow this down, tell me:

• What Identity Provider (IdP) are you currently using (e.g., Okta, Microsoft Entra ID)?
• Are your employees remote, on-site, or a hybrid mix?
• Roughly how many users are you deploying this for?

I can give you a more tailored architecture and rollout checklist.

If you mean a company-wide hardware security key (HSK) program, rather than just buying keys, I’d separate the problem into key hardware + identity-provider enforcement + lifecycle/inventory management.

My strongest recommendation: Yubico

For a broad enterprise deployment, Yubico is probably the best fit to evaluate first.

Its current YubiKey as a Service offering is specifically designed for organizations deploying keys at scale. The service includes a centralized Customer Portal for inventory, rollout progress, user activation, and key management, plus options for pre-enrollment and worldwide delivery.

The enterprise Security Key Series supports FIDO2/WebAuthn and FIDO U2F, with USB-A/NFC and USB-C/NFC variants. Enterprise editions also have serial numbers that can be used for asset tracking.

How I'd structure the deployment

One important distinction: the security key itself isn't usually the management system. Your Microsoft Entra ID, Okta, Google Workspace/Cloud Identity, or other IdP should enforce which authentication methods users can register and use. The hardware-management layer then handles procurement, distribution, serial-number inventory, replacements, and lifecycle.

Other option: Google Titan

If you're heavily standardized on Google Workspace/Cloud Identity, Google's Titan Security Keys are a credible alternative. They support FIDO standards, USB-A/NFC and USB-C/NFC, and Google provides organizational enforcement of security keys.

However, for a heterogeneous enterprise where the key fleet itself needs substantial lifecycle/procurement management, I'd put Yubico ahead of Titan based on the current enterprise-management offering.

What I'd want to know before choosing

The architecture changes considerably depending on your environment. In particular:

• Number of employees: 100, 1,000, 10,000+?
• Identity provider: Microsoft Entra ID, Okta, Google Workspace, Ping, etc.
• Endpoints: Windows, macOS, Linux, mobile, shared workstations?
• Compliance: SOC 2, HIPAA, PCI DSS, FedRAMP, CJIS, etc.
• Protocols needed: FIDO2 only, or also PIV/smart-card, OTP, SSH, etc.?
• Deployment model: company-issued keys, BYOD, contractors, or all three?
• Geography: single country or worldwide?

If you give me those six details, I can narrow this to 2–3 enterprise HSK management architectures, including the recommended key models, IdP configuration, enrollment/offboarding workflow, backup-key strategy, and approximate cost structure.

Its current YubiKey as a Service offering is specifically designed for organizations deploying keys at scale. The service includes a centralized Customer Portal for inventory, rollout progress, user activation, and key management, plus options for pre-enrollment and worldwide delivery.

The enterprise Security Key Series supports FIDO2/WebAuthn and FIDO U2F, with USB-A/NFC and USB-C/NFC variants. Enterprise editions also have serial numbers that can be used for asset tracking.

How I'd structure the deployment

One important distinction: the security key itself isn't usually the management system. Your Microsoft Entra ID, Okta, Google Workspace/Cloud Identity, or other IdP should enforce which authentication methods users can register and use. The hardware-management layer then handles procurement, distribution, serial-number inventory, replacements, and lifecycle.

Other option: Google Titan

If you're heavily standardized on Google Workspace/Cloud Identity, Google's Titan Security Keys are a credible alternative. They support FIDO standards, USB-A/NFC and USB-C/NFC, and Google provides organizational enforcement of security keys.

Deploying and managing hardware security keys (HSKs) like YubiKeys or FIDO2/WebAuthn-certified tokens across an entire enterprise requires a balance of physical logistics (lifecycle management, onboarding, loss/replacement) and IAM (Identity and Access Management) integration.

An effective enterprise HSK management solution combines three main pillars: hardware procurement/lifecycle programs, centralized identity provider (IdP) integration , and internal operational policies.

Phase 1: Hardware Lifecycle & Procurement Programs

Managing physical inventory for employees requires structured logistics rather than manually buying keys off retail sites.

• YubiKey as a Service / YubiEnterprise Subscription: Offered by major hardware vendors like Yubico YubiKey as a Service , this provides structured tiers (Base, Advanced, Compliance) to budget, deploy, and routinely refresh security keys across a workforce. It also streamlines self-service replacement programs for lost or broken keys.
• Pre-provisioning & Serial Tracking: For high-security environments, utilize vendors who can pre-register or batch-import hardware serial numbers/Attestation Certificates directly into your inventory asset management system before shipping them to employees.

Phase 2: Centralized Identity Provider (IdP) Integration

The HSKs themselves do not store user directory data; they act as a cryptographic token bound to your IdP. Management happens entirely via your central directory:

• Primary IdP Policy Enforcement: Integrate your keys with enterprise IdPs (e.g., Okta, Microsoft Entra ID, Ping Identity). Configure policies that require FIDO2/WebAuthn phishing-resistant hardware keys for specific groups (e.g., privileged admins vs. general staff).
• N-Key Registration (High Availability): Enforce a policy where every user must register two physical keys (primary and a backup backup/spare) during onboarding. If one key is lost at home, the user can log in with the backup instead of triggering an expensive IT helpdesk ticket.
• Self-Service Recovery Workflows: Set up secure, verified identity-proofed recovery workflows in your IdP so that if a user loses both keys, a designated admin or automated workflow can revoke the old credentials and provision a replacement safely.

Phase 3: Operational Best Practices & Policies

• PIN Protection: Mandate that users set a 6-to-8-digit local PIN on the hardware key via the vendor's manager app. This ensures that if the physical key is stolen off a keychain, it cannot be used without the user's local PIN.
• Attestation & Validation: Ensure your IdP validates FIDO2 attestation statements so unauthorized or counterfeit security keys cannot be spoofed into your corporate ecosystem.

To help tailor this deployment strategy, tell me:

• What Identity Provider (IdP) are you currently using (e.g., Microsoft Entra ID, Okta, Google Workspace)?
• Roughly how many employees need to be provisioned?
• Are you looking for a phishing-resistant passwordless rollout or a traditional 2FA (MFA plus password) approach?

For an enterprise-wide hardware security key deployment, the YubiKey 5 Series ** is the industry standard** and most widely recommended option, paired with management software like UserLock or Pointsharp for centralized lifecycle control.

Top Enterprise Management Solutions

• UserLock : Best for automated onboarding, remote enrollment, and tracking physical keys across Windows and enterprise networks.
• Pointsharp Access Management : Offers complete security key lifecycle management, audit logging, and certificate tracking for YubiKeys and other hardware tokens.
• Versasec : Provides enterprise-grade credential management for physical token revocation, automated tracking, and provisioning.

Recommended Hardware Options

Key Rollout Best Practices

1. Issue Backup Keys : Require every employee to register at least two physical keys to prevent lockouts if one is lost.
2. Integrate with SSO : Bind your hardware keys to an identity provider or single sign-on (SSO) tool like Duo or Microsoft Entra ID for seamless revocation.
3. Automate Offboarding : Establish an IAM (Identity and Access Management) policy to quickly revoke a lost key's trust status without disabling the entire user account.

Would you like help integrating these keys with a specific SSO provider like Microsoft, Google Workspace, or Duo?

Yes. For a company-wide hardware security key (HSK/FIDO2) deployment, I’d separate identity/MFA policy from physical-key lifecycle management. The strongest turnkey option I found is Yubico’s YubiKey as a Service, especially if you expect hundreds or thousands of employees.

My shortlist

1. My default recommendation: YubiKey as a Service

Yubico now provides a centralized Customer Portal for inventory, deployment tracking and user activation, plus enrollment and delivery services. It also offers an API for integrating inventory/shipment operations into your own IT workflows.

The particularly useful enterprise features are:

• Central inventory of keys and licenses
• Assignment/distribution workflows
• Pre-enrollment of keys for employees
• Global delivery/self-service ordering
• Replacement pool for lost/stolen keys and employee turnover
• Subscription reassignment when employees leave
• API access for automation
• Enterprise Security Keys with serial numbers for asset tracking

Yubico's current program has Base, Advanced and Compliance tiers. Base is FIDO-only; Advanced adds the broader YubiKey 5 functionality; Compliance covers certified models.

For a normal workforce where the goal is phishing-resistant MFA, I'd seriously consider the Security Key Series rather than automatically buying the more expensive YubiKey 5 Series.

2. If you're a Microsoft shop

If you're already standardized on Microsoft 365/Entra ID, I'd use Entra ID as the authentication authority and Intune for endpoint configuration, with YubiKeys as the physical authenticator.

Microsoft explicitly supports FIDO2 security keys as a phishing-resistant authentication method, while Entra handles authentication and Conditional Access and Intune prepares/controls the endpoints.

That gives you something like:

Entra ID → Conditional Access → FIDO2 policy → YubiKey

plus:

Intune → Windows/macOS/mobile configuration → user deployment

I'd then add YubiEnterprise/YubiKey as a Service for the physical asset lifecycle, rather than trying to make Intune serve as your key warehouse/inventory system.

3. If you're an Okta shop

Okta has surprisingly good FIDO2 controls now. It can enroll security keys on behalf of users, restrict authenticators, require user verification/PINs, and manage FIDO2 authenticator policies.

As of 2026, Okta also supports custom FIDO2 AAGUID controls and certificate-based attestation, which is useful if you want to say "only company-approved hardware may be enrolled."

I'd pair that with Yubico for the actual physical-key procurement and lifecycle.

4. When I'd choose HYPR

If your requirement is broader than "manage our YubiKeys" and you actually want an enterprise passwordless platform, HYPR deserves a serious evaluation.

Its Control Center provides centralized FIDO authenticator/policy management, enrollment, analytics, audit logs and APIs. www.hypr.com It can also provision FIDO2 credentials onto physical security keys and manage PINs/unpairing through its Windows client.

That's more infrastructure than I'd introduce just to manage a few hundred YubiKeys, but potentially worthwhile for a large or heterogeneous enterprise.

What I'd architect

For most enterprises, I'd build the program around these layers:

Identity provider
→ Entra ID / Okta / another IdP

Authentication policy
→ FIDO2/WebAuthn
→ phishing-resistant authentication
→ prohibit weaker MFA for privileged accounts

Hardware
→ standardized FIDO2 keys
→ primary + backup key per employee
→ different models only where USB-A/USB-C/NFC requirements justify it

Key lifecycle
→ centralized inventory
→ employee assignment
→ shipping/self-service fulfillment
→ lost-key replacement
→ termination/revocation
→ periodic inventory reconciliation

Governance
→ approved key models/AAGUIDs
→ attestation where appropriate
→ serial-number tracking
→ audit logs
→ privileged-user requirements

Automation
→ HRIS → IdP → key-management platform/API → shipping/provisioning

One important distinction: FIDO2 credential management and physical key asset management aren't the same thing. Your IdP knows that a credential exists for Alice; your hardware-management system should additionally know that serial-number XYZ is assigned to Alice, was shipped on date X, is her backup key, and needs to be revoked/replaced when she leaves.

Hardware

For a broad deployment, I'd standardize on USB-C + NFC where possible. For example:

Yubico YubiKey 5C NFC

$58.00

For a FIDO-only deployment, the Yubico Security Key family is worth evaluating; Yubico specifically offers USB-A + NFC and USB-C + NFC versions, including enterprise editions with serial numbers.

Bottom line: if you tell me your employee count, IdP (Microsoft Entra/Okta/etc.), Windows vs. Mac mix, compliance requirements (SOC 2/HIPAA/PCI/FIPS/etc.), and whether you need physical inventory/ship-to-home management, I can narrow this to a concrete architecture and 3–5 vendor comparison with estimated licensing/hardware costs.

Deploying and managing physical hardware security keys (HSKs)—like FIDO2/WebAuthn-compliant tokens (e.g., YubiKeys)—for an entire enterprise requires a strategy that balances user onboarding, lifecycle tracking (replacements, offboarding), and integration with your identity provider (IdP).

Top-tier enterprise options and management workflows streamline this large-scale HSK rollout:

• YubiKey as a Service (YubiEnterprise Subscription) - Best for an end-to-end hardware subscription model. It provides predictable budgeting, automated fulfillment/turnkey delivery for new hires, discounted replacements for lost keys, and centralized management options tailored for large workforces.
• Bitwarden Enterprise / Business + Hardware Keys - Combines credential and passkey management with robust FIDO2 WebAuthn/YubiKey 2FA support, SCIM provisioning, and directory synchronization (Okta, Microsoft Entra ID) to seamlessly track and enforce policy compliance at scale.
• Dashlane Enterprise + FIDO2/WebAuthn - Delivers passwordless and hardware-backed vault access leveraging WebAuthn PRF extensions . It integrates with corporate Single Sign-On (SSO) and SCIM for automated provisioning and deep activity logging.
• Enterprise Identity Providers (Okta / Microsoft Entra ID / Google Workspace) - Rather than managing physical tokens in a vacuum, tie your HSK inventory directly into your primary IdP. They handle the FIDO2 registration ceremony, enforce policies on which organizational units require physical tokens, and immediately revoke access upon employee offboarding to prevent unmanaged token sprawl.

To help narrow down the ideal architecture for your team, please let me know:

• Your approximate employee/user count
• Your primary Identity Provider (IdP) (e.g., Okta, Microsoft Entra ID, Google Workspace)
• Whether you are aiming for a phishing-resistant 2FA model or a fully passwordless rollout

Yes. For a company-wide deployment, I’d treat this as two separate layers:

1. FIDO2 hardware keys — the physical authenticator employees carry.
2. Lifecycle/identity management — inventory, assignment, provisioning, replacement, recovery, offboarding, and audit.

The second layer is what turns “we bought 5,000 security keys” into a manageable enterprise program.

My shortlist

Yubico enterprise security keys offers enterprise Security Key Series with serial-number-based distribution/usage tracking, and Yubico's current service model supports procurement, distribution and remote management at scale. Its enrollment service can also pre-enroll keys before they're shipped to employees.

HID Crescendo is particularly compelling if you need FIDO2 plus PKI/PIV, OATH, FIPS, or certificate-based authentication. HID now advertises enterprise passkey management covering issuance, recovery and audit trails, rather than merely providing a desktop configuration utility.

FEITIAN Keys as a Service bundles its hardware with KeyMS, a lifecycle-management platform covering procurement through retirement. It is explicitly designed for large-scale MFA deployments and is currently offered through a 24-month subscription model for qualifying deployments.

If you're a Microsoft shop

You may not need a separate MFA management product at all.

Microsoft Entra currently supports FIDO2/passkeys and can apply passkey profiles to targeted groups, enforce attestation, restrict key types, and require passkeys through Conditional Access. Microsoft also has a Graph-based administrator provisioning capability in preview, which can let organizations build their own key-provisioning workflow.

That's important because I'd distinguish identity management from physical-key fleet management. Entra can manage the credential's relationship to the user, but you still need an operational process for:

• Who owns each physical key?
• Which serial number was issued to whom?
• Where was it shipped?
• Is it primary or backup?
• What happens when an employee loses it?
• How do you recover keys during offboarding?
• How do you audit unreturned keys?
• Can IT provision keys without the employee doing the initial enrollment?
• How do you handle contractors and shared workstations?

Microsoft's admin provisioning capability is currently preview, so I wouldn't make that the sole foundation of a large production rollout yet.

What I'd recommend

For a 500+ employee company, I'd start with Yubico or HID, rather than trying to build the management layer yourself.

Pick Yubico if: you primarily need phishing-resistant FIDO2/WebAuthn, broad compatibility, straightforward deployment, and excellent distribution/enrollment logistics.

Pick HID if: you have regulated/high-assurance requirements, already use smart cards/PKI, need FIPS, or want one credential to cover FIDO2 + certificates + potentially physical access. HID's Crescendo Key supports FIDO2, PIV, OATH, USB-A/USB-C and NFC, with FIPS 140-3 options.

Pick FEITIAN if: hardware cost and a bundled lifecycle-management service are major considerations.

One important design decision: issue two keys per employee—a primary and a backup stored separately. HID itself recommends two keys per account because an individual FIDO key has no backup.

If you tell me (a) employee count, (b) Microsoft Entra vs Okta vs Google Workspace, (c) whether you need FIPS/PIV, and (d) approximate budget per employee, I can narrow this to a concrete architecture and compare the leading options on licensing, lifecycle management, provisioning, lost-key recovery, APIs, auditability, and estimated total cost.

If by HSK you mean hardware security keys such as FIDO2/WebAuthn keys for company-wide 2FA, I’d evaluate the solution as two layers:

1. Identity provider (IdP) — Entra ID, Okta, Google Workspace, Duo, etc. enforces MFA and handles user enrollment/revocation.
2. Hardware-key lifecycle management — inventory, assignment, shipping, replacement, lost-key workflows, auditing, and ideally automated provisioning.

My shortlist

1. Yubico — my default recommendation.
Yubico's current YubiKey as a Service includes a centralized Customer Portal for inventory, shipments, subscriptions and deployment visibility. It supports bulk fulfillment and user self-service ordering, while Yubico also offers pre-enrollment options for getting keys to employees already prepared for activation.

2. HID Crescendo — strongest if you need more than FIDO2.
HID's Enterprise Passkey Management covers provisioning, reset, lifecycle management and audit trails, and its Crescendo platform can manage FIDO credentials alongside certificates/PKI. Crescendo Keys support FIDO2, PIV/PKI and OATH, which is attractive if your organization has smart-card, certificate or regulated-environment requirements.

3. FEITIAN — worth considering for a large Duo deployment.
FEITIAN's current Keys as a Service (FKaaS) bundles FIDO security keys, its KeyMS lifecycle-management platform, fulfillment and support. KeyMS specifically tracks assignment and lifecycle from procurement through retirement. The current program advertises qualifying orders starting at 100 keys through December 31, 2026.

4. Token2 — interesting if avoiding vendor lock-in matters.
Token2 provides FIDO2 keys and management tooling, including Keyroost, an open-source cross-platform management application that can manage FIDO2 keys from any vendor. It's more of a flexible toolkit than the turnkey enterprise logistics platform I'd choose for a very large rollout.

What I'd require in your RFP

Don't buy a solution merely because it says "FIDO2 management." I'd require:

• FIDO2/WebAuthn, preferably FIDO2 Level 2-certified hardware
• Two keys per privileged/high-value user
• Central inventory: serial/device → employee → department → status
• Automated joiner/mover/leaver workflows
• Lost/stolen-key revocation and replacement
• Admin and end-user self-service enrollment
• Bulk provisioning
• Shipping/fulfillment tracking
• API/SCIM integration with your IdP/ITSM
• Detailed audit logs and exportable reports
• Multiple admin roles/RBAC
• Support for USB-A, USB-C and NFC as appropriate
• FIPS/Common Criteria options if your compliance requirements demand them
• Ability to use passkeys/passwordless, not just FIDO2 as a second factor
• A recovery strategy that doesn't devolve into SMS/email fallback

One particularly important point: the hardware-key vendor shouldn't become your identity system. Your Entra/Okta/Google/Duo environment should remain authoritative for who is allowed to authenticate; the HSK management layer should manage the physical credential's lifecycle.

What I'd choose

For a conventional enterprise with hundreds to tens of thousands of employees, I'd start with Yubico + your existing IdP and evaluate HID as the primary alternative. Yubico currently has the strongest combination of mature hardware, enterprise fulfillment, inventory visibility and deployment services.

If you tell me (a) employee count, (b) Entra/Okta/Google/Duo/etc., (c) whether you need FIPS, (d) approximate budget per user, and (e) whether you need PKI/smart-card functionality, I can narrow this to a specific architecture and hardware model.

When deploying hardware security keys (such as YubiKeys , Swissbit, or Google Titan) across an entire enterprise for 2FA/MFA, a successful management solution requires three core components: hardware procurement/logistics, identity provider (IdP) integration , and lifecycle/inventory management.

Leading enterprise hardware security key management solutions and strategies are broken down below:

• YubiKey as a Service (YaaS) / YubiEnterprise Subscription
  • What it is: A turnkey subscription model by Yubico tailored for medium-to-large workforces. It streamlines budgeting, procurement, and logistics.
  • Key features: Centralized deployment management via a customer portal, automated drop-shipping/pre-enrollment options to remote employee homes, and discounted or proactive replacement tiers for lost, damaged, or backup keys.
• Dedicated Access Management & Lifecycle Platforms (e.g., Pointsharp)
  • What it is: Specialized middleware platforms that sit between your physical tokens and your IT infrastructure.
  • Key features: Offers granular inventory tracking, explicit token-to-user binding, certificate lifecycle management alongside FIDO2/passkey credentials on the same physical key, and comprehensive audit reporting for compliance frameworks.
• Identity Provider (IdP) Native Management (Okta, Microsoft Entra ID, Ping Identity, JumpCloud)
  • What it is: Managing hardware keys directly within your primary directory or single sign-on (SSO) provider.
  • Key features: Users self-service or IT admins provision FIDO2/WebAuthn keys directly to user profiles. Modern IdPs support mandatory backup key policies, conditional access rules (e.g., requiring hardware-bound keys only for privileged or remote administrative access), and remote de-provisioning if a physical key is compromised.

To help tailor this to your environment, let me know:

• Approximately how many users need hardware security keys?
• What Identity Provider (IdP) or directory service are you currently using (e.g., Microsoft Entra ID, Okta, Google Workspace)?
• Do you need support for remote/shipping logistics or purely internal IT provisioning?