What MFA hardware tokens are you using with O365 / G Suite?

[pete]

We're likely to need a few hardware tokens for some staff.

 

What (if anything) are you using?

 

I'm looking at Token2's programmable options (https://www.token2.com/shop/product/token2-c301-i-programmable-hardware-token-iphone-compatible, for example) currently as I'd prefer not to have "OK, is the token plugged in?" support calls with Yubikey options.

[Sibrows]

Yubikey for both my teams.

The equivalent Authenticator App on their personal phone for anyone else.

[thimon]

We’re mid rollout of MFA and are using that exact same Token2 device for the odd users that cannot use the Microsoft Authenticator App. Works really well and is easy to setup.

[RobFuller]

We are also mid rollout of MFA and have offered some staff these https://www.amazon.co.uk/dp/B07M8YBWQZ/ref=cm_sw_r_cp_apa_glt_fabc_XKH6J48Q43JNM7J5EYNC use one myself as backup to Auth app.

[dhicks]

What (if anything) are you using?

 

We've rolled out Yubikeys to senior management and admin staff as a start, we're considering what we do with other staff - those Token2 devices look like a good option, thanks.

 

Something we want to test out if we can:

 

https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/

 

Evilginx is a server that proxies a site, to which you can point a nearly-the-same domain name (g00gle.com, etc) in the hopes of phishing someone to visit your site thinking it's the original and capturing their login details. The above article points out that using a one-time-code 2FA mechanism doesn't protect against that kind of attack. However, I suspect if your site is using login-with-Google (or Microsoft, or other provider) that should offer suitible protection as Google (for instance) requires a valid host URL to be entered on their OAuth login setup to use login-with-Google on your site.

[foofighterjim]

I've been looking at: https://deepnetsecurity.com/authenticators/one-time-password/safeid/hardware-mfa-tokens-office-365-azure-multi-factor-authentication/ The Diamond tokens can be used if you don't happen to have an Azure P1 or P2 subscription but do cost a couple of pounds more than the others.

[Brixy]

If you don't have P1 or P2 liicenses then you could use a programmable token like safeid/diamond (Fido keys could also be considered however there is a higher cost factor per unit).