What’s the cleanest way to enroll passkeys and Windows Hello during Autopilot onboarding?

We're redesigning our new-hire onboarding process so users register both Windows Hello for Business and a passkey through Microsoft Authenticator as early and smoothly as possible.

Our current setup uses two Conditional Access policies. One requires registration with a custom authentication strength that allows Temporary Access Pass (TAP), Windows Hello for Business, FIDO2, and certificate-based authentication. The other requires phishing-resistant MFA, but we currently exclude resources such as the Microsoft access panel, Windows Azure Active Directory, the Azure Credential Configuration Endpoint Service, and AAD Reporting because they interfere with Autopilot.

Devices are pre-provisioned, then a TAP is generated. During the user setup, they see the "Let's keep your account secure" prompt, followed by Windows Hello setup indicating that passkeys need to be saved on the device. After selecting Next, the process fails and the enrollment breaks.

If I manually open Microsoft Authenticator and register the passkey first, then run through the process again, everything works much better. Windows Hello is prompted after the account setup phase of the Enrollment Status Page and completes successfully.

The process technically works, but it requires very specific instructions for new users, and I'm not comfortable relying on several resource exclusions. Another option would be automating a group change so phishing-resistant MFA is enforced only after Autopilot finishes, but that adds more administration and creates a possible security gap.

Has anyone found a cleaner and more reliable way to handle passkey and Windows Hello enrollment for new hires during Autopilot?