We're a small public library with about 20 employees and are finally implementing MFA for Microsoft 365 and a few vendor accounts. We plan to use YubiKeys for FIDO2 and older MFA methods such as TOTP, but not as passkeys or a complete password replacement. Employees will still use their normal passwords, with the hardware key providing a second authentication factor.
We don't use employee ID badges or key fobs, and staff generally do not use personal phones or other personal devices for work authentication. Some employees only need to access work systems while they are on-site, so management would like to let them either keep their primary key with them or store it securely at the library.
The initial idea is to purchase two keys per employee: a primary and a backup. I'm considering two small, wall-mounted locking cabinets with around 30 labeled slots each—one in the server room for backup keys and another in a secure staff-accessible area for daily-use keys. The total cabinet budget is roughly $100–$200.
Since I'm the only IT person, I'd like a recovery option that doesn't depend on me being available every time someone loses a key, forgets a PIN, or has a damaged device. Does this approach make sense, or would a smaller pool of spares, break-glass access, temporary access passes, or another process be safer and less expensive? Are there particular cabinet types or products that would work well for storing and labeling YubiKeys?
4 Answers
I’d avoid pre-provisioning a backup key for every employee and storing all of them together. A key by itself may not be enough if passwords are still required, but it still creates unnecessary exposure and makes mix-ups, lost tokens, and access control harder to manage. Have each employee keep their active key under their control, then maintain a small number of sealed replacement keys instead of one spare per person.
Use the identity provider’s recovery features instead of keeping dozens of individually assigned backups. For Microsoft accounts, look into temporary access passes or a tightly controlled emergency administrator account that can register a replacement key. Store a couple of break-glass keys and unopened replacement YubiKeys in a locked location, with access logged and tested periodically.
Whatever recovery method you choose, test it before an emergency. It’s easy to discover that a spare key is damaged, a PIN is forgotten, or the recovery account lacks the permissions you expected only when someone is locked out.
For the actual hardware, you probably don’t need a specialized YubiKey cabinet. A small commercial key cabinet with numbered hooks or compartments should work, provided the slots fit the keys and labels cannot fall off. However, I’d spend more effort on the procedure than the cabinet: keep active keys with their users whenever practical, retain only a few centrally managed spares, record each token’s owner and status, and immediately revoke a key that is lost.
Since some staff only work on-site and personal phones aren’t an option, an on-site storage process can be reasonable. I’d just make the cabinet controlled and auditable rather than letting everyone freely choose from a collection of keys.
If keys are kept on-site, the cabinet is only part of the security design. Decide exactly who can open it, whether access is logged, and how you verify that the person taking a key is authorized to use it. A cabinet that is freely accessible during business hours could let someone take the wrong token or collect several of them. Individual labeled compartments, an access log, and a second person required for emergency access would be safer than one unlocked box.
That’s the main concern: the recovery process should be reliable without turning a cabinet full of assigned credentials into a shared-access problem. A few properly tracked spares are easier to inventory and replace.