We're finally rolling out MFA for Microsoft 365 and a few vendor accounts. We plan to use YubiKeys for FIDO2 and older MFA methods such as TOTP, mainly as a second authentication factor rather than as passkeys or a password replacement. Employees will still use their normal passwords.
There are about 20 employees, with aggressive hiring planned, so I'd like capacity for roughly 30 users. Each person would have a primary key and a backup in case the first is lost or damaged. Employees could either keep their primary key with them or store it securely on-site, since some staff only need to access work systems while physically at the library. Backup keys would be kept in a restricted server-room cabinet.
We don't use employee ID badges or key fobs, most employees do not use work-provided smartphones, and personal devices are not allowed for authentication. I'm also the only IT person, so although I can reset MFA and register a replacement key, I'm not always available during vacations, illness, or other emergencies.
I'm considering two small wall-mounted locking cabinets with about 30 labeled slots each, ideally for around $100–200 total. Does this seem like a reasonable low-cost approach, or would it be better to keep only a few unassigned spare keys and use an emergency recovery process? If cabinets are appropriate, are there particular products or features I should look for?
4 Answers
For a small organization, generic key cabinets are probably fine mechanically; you don’t need a YubiKey-specific cabinet. Look for numbered hooks or compartments, durable tags that won’t block the USB connector, a reliable wall mount, and a lock whose access can be limited to designated supervisors. I’d use one cabinet for a small pool of sealed spares and keep employee-assigned primary keys with the employees whenever practical, rather than buying two full cabinets of provisioned keys.
If you do store assigned keys on-site, the cabinet is only part of the security model. It should be access-controlled, logged, and supervised rather than left open for anyone to browse. Each key needs a clear asset label, and you should have a process to immediately disable a missing key. A key alone may not authenticate without the employee’s password, but unrestricted access still weakens accountability and makes accidental mix-ups or intentional sharing easier.
Your constraints make hardware tokens reasonable: shared workstations, no company phones, and a requirement not to depend on personal devices. I would still treat the backup plan as an availability and account-recovery system, not just physical storage. Document who can authorize a replacement, keep a couple of tested emergency tokens, record which token is assigned to whom, and periodically verify that the emergency registration process still works with your Microsoft and vendor accounts.
I’d avoid keeping a pre-enrolled backup key for every employee. A better compromise is to keep a few sealed, unassigned YubiKeys in a restricted cabinet, along with a documented emergency process for registering one to a user. Microsoft’s Temporary Access Pass or a similar break-glass method may also work, depending on your licensing and configuration. That avoids having 30 devices sitting around with individual credentials while still giving staff a recovery option when the sole IT administrator is unavailable.
That also prevents the common problem where keys get mixed up, damaged, or discovered to be unusable only when someone urgently needs one. Test the recovery procedure periodically instead of assuming it works.