We need to enable the the security keys as a sign-in option for our Windows 10 devices in Microsoft Intune. In Intune this can be done by enabling this as part of a tenant wide Windows Hello for Business (WHfB) setting or by deploying an Identity Protection configuration policy.
Using this first option is a tenant wide setting for all users.
Open a browser to sign-in to the Microsoft Intune portal.
The same can be accomplished by using an Identity Protection configuration policy. The advantage of using a configuration policy is you can assign it to a group of users instead of all users.
The next step is to enable combined security information registration. The feature needs to be enabled from the Azure (AD) Portal.
The third step is to enable FIDO2 security keys as Authentication method in Azure Active Directory.
In above screen we also have the option to block Self-service setup of the security keys and a Key restrictions policy. If you want to block specific security keys or only allow specific security keys, you need the AAGuid of an security key. Those for the security keys of Yubico can be found here.