For anyone dealing with this error (MOS934314) when users are registering MFA for first time or after a reset.

Quick workaround:
Generate a TAP Code

direct user to mysignins.Microsoft.com/security-info
Get them to register the new via that portal rather than the first time resignation experience

Great video from @johnhammond.bsky.social on the considerations when making dynamic group memberships in EntraID.

Now thinking about how an attacker could invite a guest account with custom set attributes to be scoped into dynamic groups.

youtu.be/Ih4u2LV1BIc?...