Agent WranglersSecond factors and recovery Recommended
Ask everyone to keep two ways in
Prompt each person with one second factor to add another, such as a second passkey or a security key.
How to do it
NIST SP 800-63B-4 section 4.1.2.1 asks services to encourage at least two separate means of authentication. Offer a backup right after the first setup. Keep a reminder in settings while only one exists. A synced passkey survives a lost phone, and its backup state flag shows it. A device-bound key does not, so it needs a partner even more.
How to check
Sign in as a test user with one factor. Settings shows the reminder. Add a second factor, and the reminder goes away.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/two-authenticators.