Credential providers supported by ESA
Windows Login
Windows Login Protection by ESA provides Two-Factor Authentication (2FA) only to password-protected Windows accounts (domain or local accounts). In this case, 2FA protects the original "password credential provider."
If a Windows account can be accessed by Windows Hello, PIN, or a Microsoft account, ESA cannot provide 2FA protection for those login types.
Remote Desktop Protocol (RDP)
ESA provides Two-Factor Authentication only if the RDP client requires the first factor (username & password) before creating the remote session. Windows RDP works this way.
ESA RDP protection disables other credential providers.