u/Technical-Deer3844

Hi

We've enabled Passkeys for Admin accounts and have the system-preffered settings set to enabled instead Microsof managed.

What we notice is that, when trying to log on, the passkey becomes the preferred second factor which makes sense if we follow the docs. The annoying thing is that we don't have the option to select another second factor ( TOTP ,...).

How do you guys handle this ? Settings the system-preferred authentication to disabled ?

Just some side info, we have a CA policy in place to enforce passkey for admins but one account is shared and does not allow to save the passkey in a shared vault. Hence the reason we need to be able to fall back on TOTP.

Also curious how you guys handle this one.