The correct option is Ensure Azure Active Directory Multi Factor Authentication is enabled and push notifications are permitted as a verification method.

Passwordless phone sign in relies on the Microsoft Authenticator app to deliver push notifications that prove possession of a registered device and to approve sign ins without a password. Enabling Multi Factor Authentication and allowing push notifications makes sure the authentication flow can validate the user and complete a passwordless sign in.

Require administrators to deploy FIDO2 security keys for every user is incorrect because FIDO2 security keys are an alternative passwordless method and they are not required for phone sign in with the Microsoft Authenticator app.

Microsoft Authenticator must be installed only on Windows devices is incorrect because the Microsoft Authenticator app is supported on mobile platforms such as iOS and Android and it is not limited to Windows devices.

Users must keep a fixed password for fallback access is incorrect because the goal of passwordless phone sign in is to reduce reliance on passwords and there are other recovery or fallback options rather than requiring a permanent password.

Full AWS Practitioner Certification Question