FIDO2 security keys can be enrolled by the system administrators using the Admin Console or by the users in the login process.

Please note that the user experience of the enrollment process is primarily determined by the User Verification option in the FIDO2 policy