I'm on the hunt for FIDO2 USB tokens to use with Microsoft 365, particularly for users who either cannot or prefer not to use an authenticator app. I've noticed that the cheaper FIDO2 tokens allow for very simple PINs, like '1111' or '1234'. What are some options that ensure a higher standard of PIN complexity but don't require central management? Ideally, I'd love to buy these tokens in bulk and distribute them as needed.
1 Answer
You might want to check out YubiKeys. They have a PIN complexity policy, but just a heads up: it looks like the firmware version of the YubiKeys you buy might affect whether or not PIN complexity is enforced. We got ours from Amazon, and they don’t seem to have that enforcement. It might be best to purchase directly from Yubico or a trusted distributor to ensure they meet your requirements.
That’s frustrating! I thought the YubiKey site was pretty clear on their policy, but this seems to be a common issue. You might want to reach out directly to Yubico or check their official store.