Microsoft Intune helps high-security customers authenticate using derived credentials on mobile

The Intercede solution can also derive from PIV card to create a Yubikey PKI credential - this can be really useful for situations where a smart card form factor cannot be used. At present is is not formally part of FIPS 201-2, but the recent OMB memo (OMB-19-17) proposes that many other such form factors should be adopted over the next couple of years (FIPS 201-3 is underway).  If FIPS 201 compliance is not critical, you could of course use this sooner, giving you a broad range of cards, phones, tablets and USB keys with which you can assert your identity credentials.
The InTune platform manages the mobile device credential delivery while the Intercede MyID component is the underlying unified identity and credential management system.