Authenticator enrollment
Authenticator enrollment is the process of registering an authentication method with an account so it can be used to authenticate the account's user.
Attaching a sign-in method to an account
NIST calls the association between an authenticator and an account authenticator binding. It can happen when the account is first enrolled or later, when the user adds another method.
The method becomes available for future authentication. Enrollment itself is not a successful sign-in, and opening a registration screen does not establish that enrollment finished.
What changes during recovery
An MFA reset may remove or reset existing methods. Enrollment adds the replacement. Device registration creates a device identity in the directory. A single workflow can involve all three, but they leave different records.
For an unexpected enrollment, start with the method added, its account, and the recorded time. Compare that with the recovery approval and subsequent sign-ins. Do not copy authentication secrets into the investigation notes.
NIST requires a notification independent of the binding transaction when another authenticator is added. The notice should give the account holder a way to dispute an enrollment they did not authorize.