Thanks for your insights. We had looked at Yubikey options in the past and may again, but for the moment we’re trying to see what can be done without additional hardware. Plus we know for certain some folks will just leave a Yubikey or smartcard etc in their machine all the time.
Also, we’re all Azure/Entra/inTune - no local domain and no “Azure Domain Services” etc
The TOTP I use is generated locally on my phone, the drive of which is encrypted. Some folks at work do the same while others use the “push” style approvals. We do not use SMS.
Yubikey or smart card or other “thing you have” would certainly be an answer, but I was and still am perplexed why MS doesn’t leverage the TOTP/Authenticator App they use everywhere else at the PC account login screen. That said, I’m mostly over it, since certainly OTP is a bit more friction and user-hostile than eg fingerprint+known PIN, or even as you say a Yubikey + PIN.
Pursuing this with Windows Hello for Business for now. Multi-Factor (MFA, 2FA) for Windows Login