If the user only sets up one security key or biometric authenticator in one browser, they can't complete authentication if the browser blocks the security key or biometric authenticator, or if the device is lost. Encourage your end users to create FIDO2 (WebAuthn) enrollments in multiple browsers and on multiple devices.If the user only has one authenticator set up and it's on their mobile phone, they can't complete authentication if the phone is lost. Encourage your end users to add additional authenticators that aren't bound to a specific device.Okta recommends the following backup measures: Use this setting for authenticators that require User Verification, like FIDO2 (WebAuthn) with Touch ID. The authenticator that the user is enrolling in must support User Verification. Required: Users are always prompted for User Verification when they enroll in a FIDO2 (WebAuthn) authenticator.Preferred: Users are prompted for User Verification if they enroll in a FIDO2 (WebAuthn) authenticator that supports it.This is the default setting to provide a consistent experience for end users signing in from various operating systems. Discouraged: Users aren't prompted for User Verification when they enroll in a FIDO2 (WebAuthn) authenticator.Click Add on the FIDO2 (WebAuthn) tile.On the Setup tab, click Add Authenticator.In the Admin Console, go to Security Authenticators.

Google chrome yubikey