Use Microsoft for passkey/MFA-backed sign-in, or the local recovery account.
Recommended: enforce passkey or phishing-resistant MFA for the Microsoft sign-in app in Entra Conditional Access.