Contoso is rolling out passwordless authentication using FIDO2 security keys and the Microsoft Authenticator app. New employees receive their security keys on their first day but cannot register them because registration requires an existing credential, and the new hires have no usable password. As the Microsoft 365 administrator, you need to give each new hire a time-limited credential that lets them sign in once to complete registration of their passwordless method. Which authentication method should you enable and issue?