Going passwordless in a CMMC environment

I’d like to move my organization away from passwords and into passkeys next year. We have the licensing and infrastructure to do it, but I want to know if there are compliance issues/best practices beforehand. We’re already using MS Authenticator for MFA, and it supports passkeys. I’m assuming we’d also need to roll out WHfB for endpoints. We already use WHfB multifactor unlock for our CUI devices. We’re cloud-only and in GCC High. Advice welcome.