Are security codes allowed in the Advanced Protection Program?

[adhilto]

💡 Summary

A security-relevant setting under the Advanced Protection Program settings is not addressed in the baselines (GWS.COMMONCONTROLS.9) that may allow users enrolled bypass phishing-resistant MFA requirements.

Motivation and context

If you enable security codes under Advanced Protection Program, but disable security
codes under the main 2-step verification page, which setting takes precedence? Either
way we might want a policy disallowing security codes under the Advanced Protection
Program for consistency.

Implementation notes

Acceptance criteria

• Determine what guidance we want to give here
• Update the baseline if needed