What is a YubiKey?
A YubiKey is a physical security key the size of a small USB stick, made by the company Yubico. It works as a second factor (or fully passwordless login) by being inserted into the USB port or held against the phone's NFC reader: one tap on the key, and the login is approved. No codes to type, no battery, no network.
The key has become synonymous with the hardware key category in the same way Google has for search, but the point applies to the whole category: physical MFA is the strongest login in practical use.
Why it is phishing-resistant
The difference between a YubiKey and SMS codes or authenticator apps is fundamental. In phishing, the user is tricked into logging in on a fake page, and both the password and the one-time code can be relayed to the genuine page by the attacker in real time. Modern phishing kits do exactly that automatically, and then ordinary MFA is bypassed.
A YubiKey is built on the FIDO2/WebAuthn standard, where the login proof is cryptographically bound to the genuine website's domain: The key signs a challenge that is only valid for the right domain, and the private key never leaves the hardware. If the user is on a fake page, the signature does not match. There is nothing to steal. That is why FIDO2 keys are described as genuinely phishing-resistant MFA, and the underlying technology is the same one that powers passkeys.
More than FIDO2: one key, many protocols
A YubiKey in the 5 series speaks several protocols side by side: FIDO2/WebAuthn and its predecessor U2F for modern login, PIV (smartcard) for certificate-based login and digital signatures, OpenPGP for key storage for PGP encryption and signing, plus one-time password protocols (Yubico OTP and TOTP). In a Microsoft 365 environment that means, concretely: passwordless login in Entra ID, enforced via conditional access, with the same key on PC, mobile and the home office.
How to roll it out in practice
Three practical tips from the real world: Buy two keys per user: a primary and a backup in the drawer, so a lost key does not become a support case with a locked account. Start where the risk is greatest: administrators, the finance function and management are the ones attackers go after, and typically under 20% of users. And close the back doors: a FIDO2 key only helps if the weaker methods (SMS, phone calls) are disabled for the protected accounts at the same time. Otherwise the attacker simply calls the helpdesk and asks for a reset.
How MI Support IT can help
We deploy and operate hardware keys as part of customers' MFA and zero trust setups: policies in Entra ID, rollout to the right user groups, backup procedures and hardened reset processes, as part of your overall IT security. Contact us if your most important accounts are still protected by a text message.