Credential providers supported by ESA
Windows Login
Windows Login Protection by ESA provides two-factor authentication (2FA) only to password-protected Windows accounts (domain or local accounts). In this case, the original "password credential provider" is protected by 2FA.
If a Windows account can be accessed by Windows Hello, PIN, or a Microsoft account, ESA cannot provide 2FA protection for those login types.
Remote Desktop Protocol (RDP)
ESA provides two-factor authentication only if the RDP client requires the first factor (username & password) before creating the remote session. Windows RDP works this way.
ESA RDP protection disables other credential providers.