RAISING SECURITY WITH ORGANIZATION-WIDE YUBIKEY (FIDO2) IN ENTRA ID

Summary from the TLDR InfoSec newsletter

Hunt & Hackett details its end-to-end YubiKey FIDO2 rollout for Microsoft Entra ID, using phased conditional access enforcement to mandate phishing-resistant hardware authentication for specific users and actions. Its approach includes automated Temporary Access Pass (TAP) provisioning for onboarding and fallback, access packages for exceptions, and robust monitoring of breakglass accounts. Key lessons include session token control and cross-platform testing prior to full enforcement.