We are deploying O365 in my company (Teams, Sharepoint, Exchange online, Office suite). In order to connect outside our network (remote workers especially during this pandemic), we've implemented MFA with MS Authenticator and OTP with SMS.
Some users use their professional phones, others their personal ones for MFA, but some do not have professional phones AND don't want to use their personal ones for privacy. Giving them a hard token is an issue for us as it is difficult to manage for logistics and support.
We are thinking about soft tokens in the PC itself. Do you think it is secure enough? What is the risk? If there is a keylogger in the PC, even if the attacker is getting the password and the PIN for the soft token, how he can use it on another PC as the soft token was enrolled only in the first machine?