Should I Apply Conditional Access Policies to My Break Glass Account?

You're seeing that because the MFA registration policy is enforcing Authenticator setup, which may be set to MS-Managed by default. You should exempt your break glass account from these settings. Also, for your second question, I suggest creating a specific Conditional Access policy for your break glass account that only requires the FidoKey. It would keep your account secure while ensuring it won't be affected by normal login policies.

Just to clarify, that enrollment campaign is part of the Authentication Methods and is not linked to Conditional Access. You can choose to disable the campaign or exclude your break glass account from it. Also, for security reasons, I would recommend not exempting the break glass account from Conditional Access entirely; instead, create a more stringent policy that limits access to just the FidoKey. This will help maintain a higher level of security.

It's actually a best practice to keep the password for your break glass account stored offline to avoid tenant lockout. Ideally, having at least two accounts for this purpose is recommended. It sounds like you have 2FA set up. Still, Microsoft may require the authenticator due to their MFA registration policy for new setups. Have you considered making sure your break glass account is separately targeted in the policy settings?