Support hardware security keys (YubiKey, Titan) via WebAuthn/FIDO2 as a two-factor authentication method. Allow administrators to require hardware keys for specific roles or all users.
TOTP apps can be phished or sim-swapped. Hardware keys are the gold standard for authentication security, and enterprise clients increasingly require them for ad platform access.
