Create Emergency Access Accounts for Azure AD and Use Log Analytics to Monitor Sign-ins from Them

Another thing to think about is the lifecycle of the biometric “donor” user for FIDO keys. What happens when they leave the org? Will the FIDO2 key be refreshed, or will this be forgotten about?

Just to elaborate any org going down this route would need to think about an off-boarding process/ hand over process to bind the FIDO key to a new user. A real world analogy would be the process to transfer nuclear lauch authority codes to the incoming President. Not something you want to forget about 😏