Microsoftpadmaprasad Thanks for the detailed response, it’s really weird scenario, I fully agree with you. Perhaps, it might be easier to enable a temporary exception on Conditional Access rules (for instance, via temporary Azure AD group membership) to allow a user X to deactivate unused/unavailable 2FAs and enroll a new one, for example FIDO2 key(s). I strongly believe that self-service capabilities provided by IT folks to end users should prevail in such scenarios, as it’s usually more scalable and reliable solution in the long term. Moreover, it’s more cost effective 😉
