A social engineering attempt on a senior account nearly made it through our M365 recovery flow last month. The attacker had enough personal information to pass knowledge-based verification and the attempt only failed because someone on the helpdesk escalated instead of processing it.

After that I went looking at what Microsoft offers for account recovery beyond knowledge-based fallbacks and found that Microsoft Entra has started integrating with identity verification vendors for biometric-backed recovery as a replacement.

I had not seen this in production anywhere and cannot find guidance on how enrollment works for an existing user base that never went through biometric verification at onboarding. If anyone in enterprise M365 environments has deployed this, the real production experience is what I want to understand.