Did exactly this at my previous employer as part of a large plan to become effectively unphishable. With all auth requiring something physical, and no OTP anywhere.<p>We deployed Yubikeys to every employee (5 Nanos), which went into a USB port on their MBPs and were told never to remove them. We rolled out Okta as well (similarly moving from GSuite).<p>Definitely took some training initially, but after that employees are used to Okta + a Yubikey touch to authenticate to all the systems we used.<p>Internal SSH as well used certs deployed onto the Yubis, to ensure SSH was physically backed.<p>With hardware devices all remote managed through MDM, and enforcing access policies, and full disk encryption, along with the Yubis, you can end up with an incredible amount of protection again phishing and other remote attacks. Even lost hardware is protected, and can be remote wiped.<p>After building all that infra, now I wish I had more Yubi support at home. So few serious services (eg. banking) that I care about support it. I can lock my Github with 2FA supporting Yubi keys,but not my bank, broker, mortgage, etc.