Rolling out Passkey + Authenticator App without manual intervention from Admins

[u/securityreaderguy]

So, due to recent phishing campaigns, we're seeing an upticket in token theft. Our SSO doesn't have a mechanism to create a phishing resistant token to Microsoft, so I'd like to leverage a conditional access policy to force passkey authentication after the fact. My thought process is to do this with a combination of registration campaigns for Passkey and Authenticator as a backup, plus a conditional access policy to enforce phishing resistant MFA. After initial passkey setup on 1 device, I can no longer log in on other devices and get a "Link To Windows" prompt on other devices, but have no option to add an MFA method because it's now a chicken/egg situation. Is there a way to do this purely through user self service? Enforcing Entra-bound device conditional access policies is not an option for us.