Microsoft Intune helps high-security customers authenticate using derived credentials on mobile

This is focused on the scenario where you do not have a physical token.  The idea of a derived credential is that you create a new credential (in this case, a certificate) that is derived from some stronger logon format.  Many customers that have certificate based authentication use smart cards, and this solution helps those customers.  In many cases the existing strong auth (mfa) challenge like a smart card is used to proof your identity so that you can obtain a secondary logon credential that can be pushed to the device.  Intune, along with our partners, enables this type of solution.