The point of hardware keys is to protect against online takeover. Physical access is usually game over either way

And if the PIN is complex enough, bruteforcing or guessing won't work as I believe the default behavior is to wipe the secure element storage after 8 incorrect attempts (with 3 attempts per key being initialized at a time).

I assume Microsoft is hoping to make Windows the main Webauthn provider out there, to tie online identities into the Windows login process for easier tracking/advertising.

https://learn.microsoft.com/en-us/azure/active-directory/aut...

bummer

If your security model requires you retaining that level of control over your user's device security, MDM seems like the only option.

I hope that both the person to whom you are replying and their users and bosses remember that once someone has that level of control, it's not really that user's device any more.

Where I work, we debated this sort of setup, but rejected it in favor of NFC Yubikeys largely on privacy grounds. We had several employees (doctors and nurses among them, since we are a medical practice) object to a device management profile, especially because of the remote wipe permission.

Instead, we adopted Yubikeys and an automated provisioning process with a break-glass procedure if someone gets locked out.