skylake and newer windows 7 POA
The POA screen needs to be improved in V8 to fully support tokens (2 factor) and other usb devices.
According to articale 123749:
USB devices such as smart cards, tokens, and possibly some external human interface devices (HIDs) do not work on SafeGuard Device Encryption POA. These devices interact with the Extensible Host Controller Interface (XHCI), which is not planned to be supported by Sophos SafeGuard Device Encryption.
This is simply unacceptable as bitlocker does not support hardware 2 factor either. This needs to be revisited.