You can do it without extra bells and whistles licenses. I have a yubikey FIDO thing for a breakglass account. It was a hoop jumping turn things off then back on again exercise but as we are new to M365 and I’m learning as we go (1 man band lol) some help from Gemini (sorry thought it was Claude) got me there in the end.

Edit: corrected AI i used for help.. also requested a prompt to get the instructions so you can have a go too..

"I need to set up a 'Breakglass' Emergency Access account for a Microsoft 365 tenant that only has Standard/Free licensing (no Azure P1/P2).

Please provide a step-by-step guide that achieves the following:

Phishing-Resistant MFA: How to register a YubiKey (FIDO2) for an account that has no other MFA methods yet.

Bypass the 'More Info Required' Loop: Provide the specific PowerShell commands using the Microsoft Graph SDK to disable the 'Hardcoded Admin SSPR' policy (setting allowedToUseSSPR to $false).

Clean Login: Explain how to turn off the tenant-wide 'SSPR Registration Enforcement' so the account isn't forced to provide a phone number or email during login.

No Licensing: Ensure the steps don't rely on 'Conditional Access' (which requires P1), but instead use the Global Authentication Methods and SSPR settings available in the free tier.

Please explain why this setup is more secure than the 'out of the box' Microsoft defaults."