[jf]

(Disclaimer: I’m an Okta employee)

Okta works really well in your use case. I recommend trying it out yourself.

Since you mention YubiKeys, I’d also suggest that you try removing passwords from your setup entirely by using YubiKeys and one or more other factors.

If you don’t want to use Okta, I’m also happy to give you my take on the alternatives to consider. Feel free to reach out to me directly.