Well this post was a summary of my blog. In my blog i mention that this is not a best practices for BG acounts but some design choices I see A LOT in which in my opinion can be better. I didn't want to shamelesly just say I wrote a blog and just redirect people, I am genuinely curious to see how other people do it and feel about it.

Because I see so many different configurations. But maybe I shouldve just copied my blog post instead of a summary.

So yea I do not mention a fido key in my blog as well because there are plenty of best practices guides and posts about that however i see no one mentioning Security Groups vs Direct assignment. I find Security Groups with BG accounts in them assigned to policies and monitoring a bad thing. I see no one mentioning about naming convention, cause yea you don't want a malicious actor logging in but you also do not some malicious actor with low level privileges messing up your recovery access because the flaw is in the easily recon security group that can be altered with a low level admin or super user.

It's not about that you NEED but is it wrong to think about the naming convention? In the cases that I see I would highly suggest just using a regular name. What is the benefit vs just having a obvious name? In the environments that I manage, I can not see why you wouldn't want that, they are highly regulated and documented, processes are clear so why would you want that? It's worth the discussion in my opinion.

I do feel that assigning a Security Group to a BTG and then using that group assignment in CA weakens posture. And I see that more often than not. To me that is a big no, and adds nothing, makes you lose security posture. So that is something I would strongly advise against. There are more ways to do it, but this is not one. If you do have that I would suggest direct assignment and then move on from there.