FIDO2 security keys in Azure AD Conditional Access: Acceptance in OAuth 2.0 Authorization Code flow with PKCE remains undefined

Goal

Determine whether a registered FIDO2 security key can be used as the MFA factor for a client application that initiates an OAuth 2.0 Authorization Code flow with PKCE against Azure AD.

Constraints & Uncertainty

Azure AD Conditional Access must be enabled for FIDO2, the key must be registered in the tenant, and the application must request the appropriate scopes. Documentation confirms browser‑based sign‑in works, but the behavior for application sign‑in via the Authorization Code flow is not explicitly defined.

Key Questions

1. Does Azure AD accept a FIDO2 security key during the OAuth 2.0 Authorization Code flow with PKCE?
2. If accepted, what client‑side requirements or libraries are needed to present the key during the flow?
3. If not accepted, are there documented workarounds or alternative MFA methods that can be used in this scenario?