Post

IMHO the reasoning behind such a recommendation is to reduce dependencies that could prevent login / function of the breakglass account. The more you add, the more could go wrong. I think good alerting and monitoring for usage might be a better approach.

Microsoft is enforcing MFA on all accounts accessing admin portals and APIs, so I think that way of managing breakglass accounts are over. Register 2-3 FIDO2 security keys locked up in a safe with only access for trusted individuals, test them yearly, and monitor the accounts for sign-ins. Right?

Right, so there is no need for a policy to enforce FIDO2 auth strength via CA policy for them. Just register only a Yubikey and that will have to be used. No policy, no opportunity to be messed up. Agreed on the alerting, test and monitoring and safe storage. Should be more than one safe, though.