The NIST AAL3 specification requires
In order to authenticate at AAL3, claimants SHALL prove possession and control of two distinct authentication factors through secure authentication protocol(s)
Consider a Windows 10 tablet device with a Hardware TPM (v2.0) and Windows Hello for Business. The private keys for the user can only be used in conjunction with either the PIN or the biometrics on the device. The device is AD domain enrolled and only used within the organisation. The specific use case is for FIDO2 (WebAuthn) authentication using WHfB as the authenticator
Would the audience consider that the user's identity (private key in TPM) on the device is sufficient for the possession and control element of something you have in the specification?
Or do people believe that the device must be single user to achieve this? (i.e. the physical possession precludes anyone else having access - cf. yubikey / token etc)
I have searched high and low for opinions on this on the web and the only reference to it I have found is from Microsoft themselves:
Windows Hello for Business incorporates two of these factors: something you have (the user's private key protected by the device's security module) and something you know (your PIN). With the proper hardware, you can enhance the user experience by introducing biometrics. Using biometrics, you can replace the "something you know" authentication factor with the "something that is part of you" factor, with the assurances that users can fall back to the "something you know factor".
It would seem to me that this would be a common use case, with the rise in the number of devices capable of securing keys through hardware security capabilities and the inherent cost savings of a shared device and fewer things to lose