In Tenant Admin Portal, you must enable Allow Credential Updates and Enrollment to enroll credentials in Windows Login app. For more details, refer to How to enable Allow Credential Updates and Enrollment in Windows Login application

Ensure that either the user’s Primary ID or email ID matches the username configured in the Tenant Admin Portal.

Face and PIN credential should be enabled in the Windows Login application.

You must enable the Face followed by PIN MFA toggle in the Windows Login application. For more, refer to Windows Login - How to Enable Face Followed by PIN MFA.