By default "mobile devices without USB ports" can bypass Yubikey authentication. It can be changed in the multifactor auth Yubikey settings.