Comment by Fysi

Two reasons why orgs restrict the AAGUIDs down to MS Authenticator:

1. Verification of the legitimacy of the passkey. 2. Passkeys are a support nightmare if you don't restrict what can be used, and the only way to restrict is by using attestation.

If you don't restrict down, there is nothing stopping someone from setting up a passkey in Edge or Chrome or Windows Hello (not Windows Hello for business), and depending on what device or profile they are signed into, when they go onto another device, no passkey.

If someone is a single device user and only uses their corp device to access, and the corp only cares about phishing resistant MFA from an Entra perspective, as part of the auth strength configuration, Windows Hello for Business is enabled by default.